---
id: "CVE-2026-111673"
kind: "vulnerability"
aliases: ["CVE-2026-111673"]
title: "IceCMS through 4.1.5 contains a missing authentication vulnerability that allows unauthenticated attackers to\u2026"
severity: "critical"
cvss: 9.8
epss: null
exploited: false
status: "open"
category: "other"
products: [{"name": "IceCMS", "fixed": [], "affected": "<= 4.1.5", "ecosystem": "vendor"}]
ecosystems: []
tags: ["cms", "icecms", "java", "other", "self-hosted", "shiro"]
not_affected_if: ["backend-not-exposed", "default-config"]
published_at: "2026-10-16T18:17:49+00:00"
first_seen_at: "2026-10-23T21:57:13+00:00"
updated_at: "2026-10-23T23:31:02+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-111673", "first_seen_at": "2026-10-23T21:57:13+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-10-23T23:31:02+00:00"}]
---

# IceCMS through 4.1.5 contains a missing authentication vulnerability that allows unauthenticated attackers to…

IceCMS (Thecosy) through 4.1.5 has no Shiro filter entry for /User/**, so the whole backend UserController runs unauthenticated. An attacker can send PUT /User/updateUser to set any userId's password and role (admin takeover). DELETE /User/deleteUser/{id} deletes any account, and POST /User/userDisableById disables any account. CVSS v4 9.3. No patched release exists.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:IceCMS affected <= 4.1.5 fixed ?

## How to check

Check ShiroConfig.java (IceCMS-ment/.../configuration/) for a filterMap entry for /User/**; if it is absent your build is exposed. As a test on your own instance, an unauthenticated PUT /User/updateUser with a JSON body returning a success message means it is exposed. Review the user table for unexpected password or role changes, and for deleted or disabled accounts.

## Fix

No fixed version known; the project publishes no releases and I found no upstream patch. Mitigate: add filterMap.put("/User/**", "jwt") plus a role check, and make JwtFilter reject empty Authorization headers. Or block /User/updateUser, /User/deleteUser and /User/userDisableById at the reverse proxy and keep the backend off the public internet. Reset admin passwords if tampering is suspected.

## Timeline

- 2026-10-23T21:57:13+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-111673
- 2026-10-23T23:31:02+00:00 analyst — VulnCheck advisory + reporter's hackmd write-up (source-read, not executed). No fixed version: GitHub has no releases/tags, no vendor fix found. Not exploited per sources; no runnable PoC, only illustrative requests. Social search skipped (no CVE chatter found). Sibling CVEs exist (e.g. CVE-2026-111685/86 SQLi, same product).

## Documents

- [advisory] VulnCheck: IceCMS through 4.1.5 Missing Authentication via /User https://www.vulncheck.com/advisories/icecms-through-4.1.5-missing-authentication-via-user-administrative-endpoints
- [describes] hieuPenguinnn: IceCMS backend /User unauthenticated account takeover (source analysis, unexecuted) https://hackmd.io/@hieuPenguinnn/icecms-backend-user-admin-unauth-account-takeover
- [mentions] IceCMS releases (none published) https://github.com/Thecosy/IceCMS/releases

## From the sources

IceCMS through 4.1.5 contains a missing authentication vulnerability that allows unauthenticated attackers to modify, delete, or disable any account because /User/** is excluded from the Shiro jwt filter. Attackers can send PUT requests to /User/updateUser to set a new password and role on any userId, including administrators, enabling full account takeover.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_