CVE-2026-111673: IceCMS through 4.1.5 Missing Authentication via /User Administrative Endpoints

Q: Which deployments are exposed?

IceCMS versions through 4.1.5 are affected where the administrative /User/** endpoints are reachable by an attacker. The issue is in the Shiro JWT filter configuration, which excludes those endpoints from authentication.

Q: What does an attacker need to exploit this issue?

No authentication, privileges, or user interaction are required. An attacker can send a PUT request to /User/updateUser and target a userId, including an administrator account.

Q: What can an attacker do after exploiting it?

An attacker can set a new password and role for an account, enabling takeover of administrator accounts. They can also modify, delete, or disable accounts through the affected administrative endpoint area.

Q: What can be done while patching is unavailable?

Restrict untrusted network access to /User/** administrative endpoints and ensure they are protected by authentication at a reverse proxy or other access-control layer. Because the application JWT filter excludes these paths, do not rely on that filter to protect them.

Published Oct 16, 2026

Updated

IceCMS through 4.1.5 contains a missing authentication vulnerability that allows unauthenticated attackers to modify, delete, or disable any account because /User/ is excluded from the Shiro jwt filter. Attackers can send PUT requests to /User/updateUser to set a new password and role on any userId, including administrators, enabling full account takeover.

Affected Software

1 affected component

icecms icecms<=4.1.5

Event History

Oct 16, 2026

CVE Published

via MITRE·05:39 PM

Data Sourced

via MITRE·05:39 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Which deployments are exposed?

IceCMS versions through 4.1.5 are affected where the administrative /User/** endpoints are reachable by an attacker. The issue is in the Shiro JWT filter configuration, which excludes those endpoints from authentication.

What does an attacker need to exploit this issue?

No authentication, privileges, or user interaction are required. An attacker can send a PUT request to /User/updateUser and target a userId, including an administrator account.

What can an attacker do after exploiting it?

An attacker can set a new password and role for an account, enabling takeover of administrator accounts. They can also modify, delete, or disable accounts through the affected administrative endpoint area.

What can be done while patching is unavailable?

Restrict untrusted network access to /User/** administrative endpoints and ensure they are protected by authentication at a reverse proxy or other access-control layer. Because the application JWT filter excludes these paths, do not rely on that filter to protect them.

CVE-2026-111673: IceCMS through 4.1.5 Missing Authentication via /User Administrative Endpoints

Affected Software

Event History

Frequently Asked Questions

Which deployments are exposed?

What does an attacker need to exploit this issue?

What can an attacker do after exploiting it?

What can be done while patching is unavailable?

Company

Resources

Contact

Frequently Asked Questions

Which deployments are exposed?

What does an attacker need to exploit this issue?

What can an attacker do after exploiting it?

What can be done while patching is unavailable?