IceCMS 4.1.5: CVSS 9.3 Bug Lets Unauth Users Wipe Accounts and Steal Admin Rights

The National Vulnerability Database has published details regarding CVE-2026-111673, a severe security flaw impacting the IceCMS content management system. This vulnerability affects all versions of the software up to and including release 4.1.5. Organizations running these versions face immediate exposure to unauthorized account manipulation.

The issue stems from a missing authentication check within the application's security framework. According to the NVD record, the Shiro jwt filter excludes the /User/** path, leaving it unprotected. This configuration error allows anyone on the internet to interact with user management functions without presenting valid credentials.

Technical Context

Attackers exploit this gap by sending PUT requests to the /User/updateUser endpoint. This action permits the modification of password hashes and role assignments for any user ID within the system. The National Vulnerability Database assigns this flaw a CVSS score of 9.3, classifying it as critical. The underlying weakness is identified as CWE-306, missing authentication for a critical function.

Affected Systems

Thecosy, the vendor behind IceCMS, is the source of the affected software. Any organization deploying IceCMS version 4.1.5 or earlier is vulnerable to this specific attack vector. The flaw enables full account takeover, meaning an attacker can elevate their privileges to administrator status. This grants them complete control over the content management system and its underlying data.

Defender's checklist

Security teams should immediately inventory their web applications to identify any instances of IceCMS. Verify the exact version number running on production and staging servers. If the version is 4.1.5 or lower, isolate the affected systems from public networks to prevent exploitation. Monitor server logs for unusual PUT requests targeting user update endpoints, which may indicate active abuse.

Operational impact

When an unauthenticated takeover vulnerability is disclosed, operations teams must assess how exposed their user management interfaces are. Check whether external vendors or suppliers host their own instances of this software, as their compromise could impact your supply chain. Notify legal and compliance departments, as data integrity may be at risk. Ensure internal communication channels are prepared to handle urgent vendor updates or incident response procedures.

Background: Incident response plans

An incident response plan is a documented procedure for detecting, containing, and recovering from security breaches. It defines roles, communication channels, and technical steps to minimize damage, preserve evidence, and restore normal operations quickly.

Read the full guide: Incident Response Plans: Why Your Security Tools Fail Without One

What to do and how to stay safe: IceCMS

• Audit all web servers to confirm if IceCMS is installed and identify the specific version numbers.
• Restrict network access to the application's user management endpoints until a patch is available.
• Monitor authentication logs for unauthorized password changes or role modifications across all user accounts.
• Wait for the vendor to release a security update that addresses the missing authentication filter.

Step-by-step guide: Patch Management vs Vulnerability Management: The Critical Distinction

General security guidance from the InfoSec Ledger newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

Which versions of IceCMS are vulnerable to this critical flaw?

IceCMS versions up to and including 4.1.5 are affected by CVE-2026-111673.

How do attackers exploit this vulnerability?

Attackers send PUT requests to /User/updateUser to reset passwords and roles without authentication.

What is the severity rating of this vulnerability?

The National Vulnerability Database rates CVE-2026-111673 as critical with a CVSS score of 9.3.