{"id":"CVE-2026-111673","kind":"vulnerability","aliases":["CVE-2026-111673"],"related":[],"title":"IceCMS through 4.1.5 contains a missing authentication vulnerability that allows unauthenticated attackers to…","description":"IceCMS through 4.1.5 contains a missing authentication vulnerability that allows unauthenticated attackers to modify, delete, or disable any account because /User/** is excluded from the Shiro jwt filter. Attackers can send PUT requests to /User/updateUser to set a new password and role on any userId, including administrators, enabling full account takeover.","summary":"IceCMS (Thecosy) through 4.1.5 has no Shiro filter entry for /User/**, so the whole backend UserController runs unauthenticated. An attacker can send PUT /User/updateUser to set any userId's password and role (admin takeover). DELETE /User/deleteUser/{id} deletes any account, and POST /User/userDisableById disables any account. CVSS v4 9.3. No patched release exists.","severity":"critical","cvss":9.8,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"IceCMS","fixed":[],"affected":"<= 4.1.5","ecosystem":"vendor"}],"ecosystems":[],"tags":["cms","icecms","java","other","self-hosted","shiro"],"not_affected_if":["backend-not-exposed","default-config"],"how_to_check":"Check ShiroConfig.java (IceCMS-ment/.../configuration/) for a filterMap entry for /User/**; if it is absent your build is exposed. As a test on your own instance, an unauthenticated PUT /User/updateUser with a JSON body returning a success message means it is exposed. Review the user table for unexpected password or role changes, and for deleted or disabled accounts.","fix":"No fixed version known; the project publishes no releases and I found no upstream patch. Mitigate: add filterMap.put(\"/User/**\", \"jwt\") plus a role check, and make JwtFilter reject empty Authorization headers. Or block /User/updateUser, /User/deleteUser and /User/userDisableById at the reverse proxy and keep the backend off the public internet. Reset admin passwords if tampering is suspected.","status":"open","published_at":"2026-10-16T18:17:49+00:00","first_seen_at":"2026-10-23T21:57:13+00:00","triaged_at":"2026-10-23T22:05:01+00:00","updated_at":"2026-10-23T23:31:02+00:00","category":"other","confidence":0.8,"triage":{"at":"2026-10-23T22:05:01Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","impact":"high","summary":"IceCMS through version 4.1.5 leaves its /User/** endpoints outside the Shiro JWT filter, so no login is checked on them. An unauthenticated attacker can change any account's password and role, including administrators, and take the accounts over.","category":"other","who_cares":["icecms","self-hosted"],"confidence":0.8,"needs_auth":"no","worst_case":"Attacker takes over any account, including administrators, without logging in.","analyst_note":"Sources do not name a patched version or a vendor fix; check the IceCMS project repository and the NVD entry for a fixed release and whether any version after 4.1.5 exists.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":["default-config"],"user_interaction":"no","needs_special_setup":"no","severity_if_unknown":"critical"},"cost_usd":0.000433,"input_tokens":2779,"output_tokens":311,"severity_before":"critical"},"analyst_status":"done","analyst_note":"Sources do not name a patched version or a vendor fix; check the IceCMS project repository and the NVD entry for a fixed release and whether any version after 4.1.5 exists.","search":"'-111673':15A,18A '-2026':14A,17A '/user':38B,101C '/user/deleteuser':63B '/user/updateuser':51B,115C '/user/userdisablebyid':70B '4.1.5':3A,31B,83C '9.3':76B 'account':67B,73B,99C,130C 'admin':60B 'administr':127C 'allow':10A,90C 'attack':12A,47B,92C,109C 'authent':7A,87C 'backend':42B 'cms':20B 'contain':4A,84C 'cve':13A,16A 'cvss':74B 'delet':62B,65B,95C 'disabl':71B,97C 'enabl':128C 'entri':36B 'exclud':103C 'exist':80B 'filter':35B,108C 'full':129C 'host':26B 'icecm':1A,21B,28B,81C 'icecms':19A 'id':64B 'includ':126C 'java':22B 'jwt':107C 'miss':6A,86C 'modifi':94C 'new':119C 'password':57B,120C 'patch':78B 'post':69B 'put':50B,112C 'releas':79B 'request':113C 'role':59B,122C 'run':44B 'self':25B 'self-host':24B 'send':49B,111C 'set':53B,117C 'shiro':27B,34B,106C 'takeov':61B,131C 'thecosi':29B 'unauthent':11A,45B,91C 'usercontrol':43B 'userid':55B,125C 'v4':75B 'vulner':8A,88C 'whole':41B","nicknames":[],"mitigations":[],"who_affected":null,"tier":null,"verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-16T18:17:49+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-111673","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-111673","severity":null,"published_at":"2026-10-16T18:17:49+00:00","modified_at":"2026-10-16T20:17:22+00:00","first_seen_at":"2026-10-23T21:57:13+00:00","fetched_at":"2026-10-23T22:28:55+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-111673:457","url":null,"severity":null,"published_at":"2026-10-23T23:31:02+00:00","modified_at":"2026-10-23T23:31:02+00:00","first_seen_at":"2026-10-23T23:31:02+00:00","fetched_at":"2026-10-23T23:31:02+00:00","note":"VulnCheck advisory + reporter's hackmd write-up (source-read, not executed). No fixed version: GitHub has no releases/tags, no vendor fix found. Not exploited per sources; no runnable PoC, only illustrative requests. Social search skipped (no CVE chatter found). Sibling CVEs exist (e.g. CVE-2026-111685/86 SQLi, same product)."}],"documents":[{"id":2016,"url":"https://www.vulncheck.com/advisories/icecms-through-4.1.5-missing-authentication-via-user-administrative-endpoints","title":"VulnCheck: IceCMS through 4.1.5 Missing Authentication via /User","kind":"advisory","source":"analyst","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":2020,"url":"https://hackmd.io/@hieuPenguinnn/icecms-backend-user-admin-unauth-account-takeover","title":"hieuPenguinnn: IceCMS backend /User unauthenticated account takeover (source analysis, unexecuted)","kind":"poc","source":"analyst","text":null,"published_at":null,"relation":"describes","confidence":null,"note":null},{"id":2021,"url":"https://github.com/Thecosy/IceCMS/releases","title":"IceCMS releases (none published)","kind":"release","source":"analyst","text":null,"published_at":null,"relation":"mentions","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}