IceCMS: Missing authentication in user administration endpoints allows account takeover
Summary
IceCMS through version 4.1.5 does not require authentication for the /User/** endpoints, because this path is excluded from the JWT filter. An unauthenticated remote attacker can send PUT requests to /User/updateUser to change the password and role of any account, including administrators. This leads to full account takeover without any user interaction.
Affected
- Thecosy IceCMS through 4.1.5
- Vendor range per CVE record: 0 to 4.1.5; the threatint mirror lists 'any version', so the exact range is not confirmed.
Fixed in
Unknown. No vendor advisory or fixed version has been found.
Workaround
- Restrict access to the backend and /User/ paths with a VPN, IP allowlist or authenticated reverse proxy.
- Block /User/ requests from the internet at the proxy or WAF (compensating control, not a fix).
Exploitation
- Public proof of concept available (third-party write-up on HackMD).
- CISA SSVC: exploitation 'poc', automatable: yes, technical impact: total.
- No evidence of in-the-wild exploitation found; CISA KEV status not verified.
Our recommendation
- Check whether IceCMS is in use, including forks, Docker images and agency-built sites.
- Restrict access to administrative endpoints immediately, especially for internet-facing systems.
- Review user accounts and administrator roles for unexpected changes and rotate all administrator passwords.
- Check web server logs for unexpected PUT requests to user management endpoints.
- Monitor the vendor repository for a fix and update as soon as one is available.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- CVE record (VulnCheck advisory) www.vulncheck.com
- ShiroConfig.java at vulnerable commit github.com
- UserController.java at vulnerable commit github.com
- HackMD write-up (PoC) hackmd.io
- VulDB CVE-2026-111673 vuldb.com
- CVE JSON record (CISA ADP) raw.githubusercontent.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 01:26.
Original description (NVD)
IceCMS through 4.1.5 contains a missing authentication vulnerability that allows unauthenticated attackers to modify, delete, or disable any account because /User/** is excluded from the Shiro jwt filter. Attackers can send PUT requests to /User/updateUser to set a new password and role on any userId, including administrators, enabling full account takeover.
NVD references (6)
- https://github.com/Thecosy/IceCMS
- https://github.com/Thecosy/IceCMS/blob/afd7a9f0d04a714e7c7e735e566c27f54b5d5201/IceCMS-ment/src/main/java/com…
- https://github.com/Thecosy/IceCMS/blob/afd7a9f0d04a714e7c7e735e566c27f54b5d5201/IceCMS-ment/src/main/java/com…
- https://hackmd.io/@hieuPenguinnn/icecms-backend-user-admin-unauth-account-takeover
- https://www.vulncheck.com/advisories/icecms-through-4.1.5-missing-authentication-via-user-administrative-endp…
- https://hackmd.io/@hieuPenguinnn/icecms-backend-user-admin-unauth-account-takeover
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.