{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/products/icecms--4.1.5/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:icecms:icecms:*:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":9.8,"id":"CVE-2026-111673"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["IceCMS (\u003c= 4.1.5)"],"_cs_severities":["critical"],"_cs_tags":["authentication-bypass","cms","web-application"],"_cs_type":"advisory","_cs_vendors":["IceCMS"],"content_html":"\u003cp\u003eIceCMS versions up to and including 4.1.5 contain a critical missing authentication vulnerability arising from an improper configuration of the Apache Shiro JWT filter. The application incorrectly excludes the /User/ URL path from authentication requirements, which facilitates unauthorized access to administrative functions.\u003c/p\u003e\n\u003cp\u003eAttackers can exploit this flaw by sending unauthenticated PUT requests to the /User/updateUser endpoint. This vulnerability permits the modification of any user account identified by its userId. An attacker can leverage this to reset passwords or escalate privileges by assigning administrative roles to arbitrary user accounts, resulting in full account takeover. The vulnerability carries a CVSS v3.1 base score of 9.8, necessitating immediate attention for any organizations hosting instances of IceCMS.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation of this vulnerability results in full account takeover, allowing attackers to modify, delete, or disable any account within the IceCMS system. By resetting passwords and elevating privileges for arbitrary user IDs, unauthorized actors can gain complete administrative control over the application, leading to unauthorized data access, system configuration changes, and potential exfiltration or destruction of sensitive information stored within the CMS.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpgrade to a patched version of IceCMS immediately.\u003c/li\u003e\n\u003cli\u003eReview all administrative accounts for suspicious modification timestamps or role changes occurring after the date of this disclosure.\u003c/li\u003e\n\u003cli\u003eInspect server access logs for anomalous PUT requests directed to the /User/updateUser endpoint originating from untrusted network sources.\u003c/li\u003e\n\u003cli\u003eIf immediate patching is not possible, apply a temporary WAF rule to block or challenge all incoming requests to the /User/ directory that do not possess a valid authentication token.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-10-16T18:45:03Z","date_published":"2026-10-16T18:45:03Z","id":"https://feed.craftedsignal.io/briefs/2026-10-icecms-auth-bypass/","summary":"IceCMS versions through 4.1.5 contain a missing authentication vulnerability allowing unauthenticated attackers to perform full account takeover via the /User/updateUser API endpoint.","title":"Authentication Bypass in IceCMS via Shiro JWT Filter Misconfiguration","url":"https://feed.craftedsignal.io/briefs/2026-10-icecms-auth-bypass/"}],"language":"en","title":"CraftedSignal Threat Feed - IceCMS (\u003c= 4.1.5)","version":"https://jsonfeed.org/version/1.1"}