Read the docs
TI-2026-75459 Aliases CVE-2026-111673GHSA-rgvr-v3r8-5gwx

Missing authentication in IceCMS lets attackers take over accounts

Priority HIGH 81CWE-306Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
Security bypass
Confidentiality · integrity · availability
High · High · High
Fix status
No fix listed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-306.

Summary

Thecosy IceCMS through 4.1.5 does not require authentication for its /User administrative endpoints, because that path is excluded from the JWT authentication filter (CWE-306). An unauthenticated remote attacker can send requests that change the password and role of any account, including administrators, or delete or disable accounts, which enables full account takeover.

Written with Claude Haiku 5.5 from the sources below · 2026-10-28

Description from the CNA

IceCMS through 4.1.5 contains a missing authentication vulnerability that allows unauthenticated attackers to modify, delete, or disable any account because /User/** is excluded from the Shiro jwt filter. Attackers can send PUT requests to /User/updateUser to set a new password and role on any userId, including administrators, enabling full account takeover.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.0055 46th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
Yes
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
ThecosyIceCMSup to 4.1.5—No fix listedCNA
  • IceCMS VendorThecosy Affected up to 4.1.5 Fixed in — No fix listed CNA

CPE names Threatist (inferred) · 1

Inferred from how NVD named this product before; not given by a source.

CPEVersionsRoleVendor
cpe:2.3:a:thecosy:icecms:*:*:*:*:*:*:*:*——Thecosy
  • cpe:2.3:a:thecosy:icecms:*:*:*:*:*:*:*:* Versions — — ·Thecosy

Remediation

The sources list no fixed version for IceCMS.

Written with Claude Haiku 5.5 from the sources below · 2026-10-28

Timeline

  1. 2026-10-16 Threatist record created from CVE-2026-111673
  2. 2026-10-16 Alias added: GHSA-rgvr-v3r8-5gwx
  3. 2026-10-18 CISA SSVC decision points changed
  4. 2026-10-18 Priority changed: MEDIUM → HIGH

References

Advisory 1

Other 3

  • TI-2024-32301 icecms <=3.4.7 has a File Upload vulnerability in FileUtils.java,uploadFile. CVSS 3.1CRITICAL 9.8
  • TI-2024-31064 IceCMS v3.4.7 and before was discovered to contain a hardcoded JWT key, allowing an… CVSS 3.1CRITICAL 9.8
  • TI-2026-75471 SQL injection in IceCMS lets remote attackers read database contents CVSS 4.0HIGH 8.7
  • TI-2025-16813 An access control issue in the component /api/squareComment/DelectSquareById of iceCMS… CVSS 3.1HIGH 7.5
  • TI-2025-16812 An access control issue in the component /square/getAllSquare/circle of iceCMS v2.2.0… CVSS 3.1HIGH 7.5
  • TI-2024-31063 An access control issue in IceCMS v3.4.7 and before allows attackers to arbitrarily… CVSS 3.1HIGH 7.6
See all 22 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences