CVE-2026-111673
9.8CriticalPublished 16 Oct 2026 · NVD status: Deferred · AI triage by gemini-3.8-flash
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
- Impact
- Full C/I/A compromise
- Weakness
- CWE-306
Impact
Unauthenticated attackers can take over any account, including administrators, across the network. They just need network access to send PUT requests to the exposed backend endpoints.
Root cause
The Shiro security configuration excludes the entire /User/** path from the JWT authentication filter.
Affected systems
IceCMS through 4.1.5
CVSS v3.1 · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Fix & remediation
No patched version is specified; block external access to /User/** at your reverse proxy or WAF immediately, or edit ShiroConfig.java to remove /User/** from the anon filter chain.
AI-suggested. Run it in staging first and check it against the vendor advisory. Why?
NVD description
IceCMS through 4.1.5 contains a missing authentication vulnerability that allows unauthenticated attackers to modify, delete, or disable any account because /User/** is excluded from the Shiro jwt filter. Attackers can send PUT requests to /User/updateUser to set a new password and role on any userId, including administrators, enabling full account takeover.
References
- https://github.com/Thecosy/IceCMS
- https://github.com/Thecosy/IceCMS/blob/afd7a9f0d04a714e7c7e735e566c27f54b5d5201/IceCMS-ment/src/main/java/com/ttice/icewkment/configuration/ShiroConfig.java#L64-L88
- https://github.com/Thecosy/IceCMS/blob/afd7a9f0d04a714e7c7e735e566c27f54b5d5201/IceCMS-ment/src/main/java/com/ttice/icewkment/controller/backend/UserController.java#L743-L818
- https://hackmd.io/@hieuPenguinnn/icecms-backend-user-admin-unauth-account-takeover
- https://www.vulncheck.com/advisories/icecms-through-4.1.5-missing-authentication-via-user-administrative-endpoints
- https://hackmd.io/@hieuPenguinnn/icecms-backend-user-admin-unauth-account-takeover