CVE-2026-111673 Details

A missing authentication vulnerability has been identified in IceCMS versions through 4.1.5. This vulnerability allows unauthenticated attackers to access administrative user management endpoints, specifically under the '/User' path. The issue arises because the Shiro JWT filter excludes these endpoints, leaving them unprotected. Attackers can exploit this by sending PUT requests to '/User/updateUser' to change the password and role of any user, including administrators, thereby taking over their accounts. Additionally, the same lack of authentication allows for the deletion and disabling of user accounts through other '/User' endpoints.

To address this vulnerability, update the Shiro filter configuration to include the '/User' administrative routes and require authentication. Additionally, implement role checks for the user management methods to ensure that only authorized users can perform these actions.