Key points
- CVE-2026-111673 is rated Critical with a CVSS score of 9.3.
- The flaw affects IceCMS versions up to and including 4.1.5.
- Attackers can modify, delete, or disable any user account via unauthenticated PUT requests.
A missing security check in IceCMS allows anyone on the internet to take over administrator accounts without logging in. This vulnerability, identified as CVE-2026-111673, carries a Critical severity rating of 9.3 on the CVSS scale. The flaw exists in all versions of Thecosy IceCMS up to 4.1.5. It permits unauthenticated attackers to modify, delete, or disable any user account on the system.
How it unfolded
- Thecosy IceCMS versions through 4.1.5 were found to exclude the /User/** path from the Shiro JWT filter.
- This configuration error allows attackers to bypass authentication requirements for user management endpoints.
- Attackers can send PUT requests to /User/updateUser to set new passwords and roles for any user ID.
Who is affected
Organizations using IceCMS versions 4.1.5 or earlier are vulnerable to this attack. According to the National Vulnerability Database, the flaw enables full account takeover. Attackers can target any user ID, including those with administrator privileges. By setting a new password and role on any account, an attacker gains complete control. The vulnerability is classified under CWE-306, which relates to missing authentication for a critical function.
What happens next
The source material does not state whether a patch or fix is available. System administrators should assume that any exposed IceCMS instance is at risk. The ability to reset passwords without authentication means that compromised accounts can be used immediately. Attackers do not need to guess credentials or exploit other weaknesses. They can directly set new passwords and roles on any user ID via the vulnerable endpoint.
The background in plain language
Authentication is the process of verifying who a user is, usually by checking a password. When a system fails to require this check, it is a missing authentication flaw. JWT filters are tools that protect web applications by ensuring requests are valid. If a specific path is excluded from this filter, attackers can bypass security checks. This allows them to perform sensitive actions, like changing passwords, as if they were legitimate users.
What to do and how to stay safe: IceCMS
- Check if your servers are running IceCMS version 4.1.5 or any earlier release.
- Monitor web server logs for unexpected PUT requests to the /User/updateUser endpoint.
- Restrict access to administrative interfaces using network-level firewalls or IP whitelisting.
- Disable the ability to change user roles or passwords via the web interface if possible until a fix is released.
General security guidance from the Circuit Observer newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
What is the CVE ID for this IceCMS vulnerability?
The vulnerability is identified as CVE-2026-111673.
Which versions of IceCMS are affected by this flaw?
All versions of IceCMS up to and including 4.1.5 are affected.
Can an attacker take over an admin account without a password?
Yes, the flaw allows unauthenticated attackers to reset passwords and change roles for any user, including administrators.
