CVE-2026-111673 in IceCMS
Summary
by MITRE • 10/16/2026
IceCMS through 4.1.5 contains a missing authentication vulnerability that allows unauthenticated attackers to modify, delete, or disable any account because /User/** is excluded from the Shiro jwt filter. Attackers can send PUT requests to /User/updateUser to set a new password and role on any userId, including administrators, enabling full account takeover.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 10/17/2026
The vulnerability identified in IceCMS versions through 4.1.5 represents a critical failure in access control mechanisms, specifically classified under CWE-287 as Improper Authentication. This flaw stems from an incorrect configuration of the Apache Shiro security framework's JWT filter chain. In this architecture, certain API endpoints are intended to be protected by authentication checks that verify user identity and privileges before allowing state-changing operations. However, the path pattern /User/** was inadvertently excluded from these protective filters. This misconfiguration creates a significant gap in the application's defense-in-depth strategy, effectively leaving sensitive administrative functions exposed to unauthenticated actors on the network perimeter.
From an operational perspective, this vulnerability allows for complete account takeover without any prior credentials or session tokens. An attacker can interact directly with the /User/updateUser endpoint using HTTP PUT requests. By manipulating parameters such as userId, password, and role within these requests, a malicious user can arbitrarily change the credentials of existing accounts and elevate their privileges to that of an administrator. This capability bypasses standard login procedures entirely, rendering traditional session management controls ineffective against this specific attack vector. The ability to modify any account includes superuser or administrative roles, which grants the attacker full control over the CMS platform, including access to sensitive data, configuration settings, and potentially server-level resources depending on how IceCMS is deployed.
The impact of this vulnerability extends beyond simple unauthorized access. It facilitates a range of malicious activities aligned with MITRE ATT&CK techniques such as T1078 Valid Accounts for initial access and persistence, and T1098 Account Manipulation to maintain control over compromised systems. Once an attacker has elevated privileges through account takeover, they can exfiltrate confidential user data, deface the website by modifying content, or install further malware if server-side execution capabilities are available within the CMS environment. The lack of authentication also implies that automated scanning tools and opportunistic attackers can exploit this flaw with minimal effort, leading to a high probability of compromise in environments where IceCMS is publicly accessible without additional network-level protections like Web Application Firewalls configured to block such direct API manipulations.
Mitigation strategies must address both the immediate code defect and broader security posture improvements. The primary remediation involves correcting the Shiro configuration by ensuring that all endpoints under /User/**, particularly those handling user modifications or deletions, are included in the authentication filter chain. Developers should implement strict role-based access control checks on these specific actions to ensure only users with appropriate administrative privileges can execute them. Additionally, implementing input validation and sanitization is crucial to prevent other potential injection attacks that might accompany this vulnerability. For organizations unable to immediately patch their systems, deploying a Web Application Firewall rule to block unauthorized PUT requests to user management endpoints provides an effective compensating control until the underlying code issue is resolved. Regular security audits of authentication filters and adherence to secure coding standards are recommended to prevent similar misconfigurations in future releases.