Update IceCMS Beyond 4.1.5 to Block PUT Request Attackers From Resetting Admin Passwords Without Auth
A critical missing authentication flaw in IceCMS allows attackers to reset admin passwords without credentials, risking full system control for users on versions 4.1.5 and earlier.
Key points
- CVE-2026-111673 rates as Critical with a CVSS score of 9.3 due to missing authentication controls.
- The flaw affects IceCMS versions up to and including 4.1.5, allowing modification or deletion of any user account.
- Attackers exploit the issue by sending PUT requests to updateUser endpoints, bypassing Shiro JWT filters entirely.
Security teams managing IceCMS content management systems must address a severe authentication bypass immediately. The vulnerability, identified as CVE-2026-111673, permits unauthenticated attackers to take over administrator accounts. This flaw exists in IceCMS versions 4.1.5 and all preceding releases. The National Vulnerability Database lists the issue as Critical, reflecting the immediate risk to system integrity and user data protection.
The risk
The core problem involves a missing authentication weakness, mapped to CWE-306. According to the NVD record, the IceCMS configuration excludes the /User/** path from the Shiro JWT filter. This oversight allows anyone to interact with user management functions without presenting valid credentials. An attacker can send a PUT request to the /User/updateUser endpoint.
By targeting this endpoint, an adversary can set a new password and assign a specific role to any userId. This capability includes elevating privileges to administrator status or disabling existing legitimate accounts. The NVD description confirms that this mechanism enables full account takeover, effectively granting the attacker complete control over the content management platform.
Who is exposed
The vulnerability affects thecosy IceCMS products up to version 4.1.5. Any organization deploying these specific versions is currently exposed to unauthenticated account manipulation. There is no distinction made in the advisory between on-premise or cloud-hosted deployments; the software version is the sole determinant of risk.
Environments that have not updated past version 4.1.5 remain vulnerable. Security operations teams should inventory their CMS installations to identify instances running these affected builds. The lack of authentication requirements means that public-facing instances are directly accessible to attackers with basic network connectivity.
Cost and compliance
The source material does not provide specific details regarding financial costs, regulatory penalties, or compliance impacts associated with this vulnerability. The NVD record focuses strictly on the technical severity and the nature of the authentication bypass. No information is provided about potential data breach notifications or industry-specific compliance failures resulting from this flaw.
Our take on the response
Security leaders should prioritize verifying the version of IceCMS across all production environments. Since the flaw allows full account takeover, the risk of persistent unauthorized access is high. Teams should assume that public-facing instances have been probed and validate that no unauthorized account changes have occurred during the exposure window.
What defenders should look for
Defenders should monitor web server logs for PUT requests directed at user management endpoints, particularly those originating from unknown IP addresses. Security teams should check for sudden password resets or role changes that lack corresponding administrative audit trails. Look for unauthorized access to admin panels following these credential modifications. Containment involves isolating affected servers and forcing a global password reset to revoke any potentially compromised session tokens.
Background: Authentication bypass vulnerabilities
Authentication bypass vulnerabilities allow users to access systems without valid credentials. They occur when applications fail to verify identity correctly at critical decision points. Developers must enforce server-side validation, avoid client-side trust, and implement strict session management to prevent unauthorized access to protected resources.
Read the full guide: Authentication Bypass Vulnerabilities: How They Work and How to Fix Them
What to do and how to stay safe: IceCMS
- Audit web server logs for unauthenticated PUT requests to updateUser endpoints.
- Verify the installed IceCMS version against the affected list and upgrade if necessary.
- Review user account roles and passwords for recent unauthorized changes.
- Once the vendor provides an update, deploy the patch immediately to all instances.
Step-by-step guide: Unpatched Software Response: Containment, Recovery, and Prevention Steps
General security guidance from the BlueTeam Herald newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Which IceCMS versions are affected by CVE-2026-111673?
All versions of IceCMS up to and including 4.1.5 are affected by this vulnerability.
What is the CVSS score for this vulnerability?
The National Vulnerability Database assigns a CVSS score of 9.3 to this flaw.
How do attackers exploit this missing authentication issue?
Attackers send PUT requests to the updateUser endpoint to modify passwords and roles without credentials.
