CVE-2026-111673 Thecosy CVE debrief

Who should care

Administrators and security teams using or managing IceCMS version 4.1.5 or earlier should assess exposure and implement mitigations or patches. They should review and apply patches, implement additional authentication mechanisms, and monitor for suspicious activity. Immediate attention is required for IceCMS users to patch or mitigate this vulnerability.

Why it matters

CVE-2026-111673 is a critical vulnerability in IceCMS that allows unauthenticated attackers to take over accounts, modify user data, and potentially gain unauthorized access to systems. Immediate attention is required for IceCMS users to patch or mitigate this vulnerability.

• Potential for full account takeover of administrator accounts.
• Ability for attackers to modify, delete, or disable any user account.
• Increased risk of lateral movement within systems using IceCMS.

Technical summary

IceCMS through version 4.1.5 has a missing authentication vulnerability for /User/** endpoints, allowing unauthenticated attackers to modify, delete, or disable any account, potentially leading to full account takeover. The vulnerability allows attackers to send PUT requests to /User/updateUser to set a new password and role on any userId, including administrators. This could lead to full account takeover, especially of administrators. Immediate review and patching are recommended for IceCMS users. The Shiro jwt filter excludes the /User/** endpoints, leading to this security issue.

Defensive priority

High priority for systems using IceCMS version 4.1.5 or earlier. Immediate review and patching recommended.

Recommended defensive actions

• Review and apply patches for IceCMS version 4.1.5 or earlier.
• Implement additional authentication mechanisms for /User/** endpoints if patching is not immediate.
• Monitor for suspicious activity on IceCMS installations.
• Review compensating controls for exposed systems while remediation is scheduled and verified.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.

Evidence notes

The vulnerability is confirmed in IceCMS version 4.1.5. Official sources and technical descriptions support the existence of this vulnerability. The CVE record was published on 2026-10-16T17:39:33.876Z and has not been modified since then. The vulnerability allows unauthenticated attackers to modify, delete, or disable any account, potentially leading to full account takeover. The Shiro jwt filter excludes the /User/** endpoints, leading to this security issue.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.