CVE-2026-111673

Summary

IceCMS 4.1.5 contains a missing authentication vulnerability (CWE-306) that allows unauthenticated attackers to fully compromise any user account by modifying, deleting, or disabling them. This occurs because the Shiro JWT filter excludes all /User/** endpoints from authentication checks, enabling attackers to send PUT requests to /User/updateUser and change passwords and roles of any user, including administrators.

Exploitability

The vulnerability is extremely easy to exploit with no prerequisites - attackers simply need to send a PUT request to /User/updateUser with a valid userId to modify any account's password and role, including admin accounts.

Blast radius

The impact is severe as attackers can gain full administrative control over the entire user base, potentially leading to complete system compromise, data exfiltration, and persistent access through compromised administrator credentials.

Detection

No reliable host or network indicator is derivable from the published description.

Prioritized remediation

Immediate remediation requires upgrading IceCMS to version 4.1.6 or later, which fixes the authentication bypass in the Shiro JWT filter for /User/** endpoints.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.