CVE-2026-111673
CriticalCVSS 9.8Summary
IceCMS through 4.1.5 contains a missing authentication vulnerability that allows unauthenticated attackers to modify, delete, or disable any account because /User/** is excluded from the Shiro jwt filter. Attackers can send PUT requests to /User/updateUser to set a new password and role on any userId, including administrators, enabling full account takeover.
Risk Assessment
The flaw allows unauthenticated attackers to take over any account, including administrative ones, leading to full system control. This can result in data compromise and further attacks.
Recommendation
Immediately update IceCMS to a patched version or fix the Shiro filter configuration to protect /User/** paths. Also verify that no unauthorized account changes have occurred.
Other vulnerabilities in IceCMS
See all- CVE-2026-111686High
IceCMS through 4.1.5 contains an unauthenticated sql injection vulnerability that allows remote attackers to inject SQL through the num path parameter of /WebArticle/findarticlesbynum. Attackers can append crafted SQL after the LIMIT clause concatenated into a MyBatis-Plus QueryWrapper to extract database contents via union-based or blind techniques.
- CVE-2026-111685High
IceCMS through 4.1.5 contains an unauthenticated sql injection vulnerability that allows remote attackers to inject SQL by supplying a crafted num path parameter to /WebResource/findresourcebynum. Attackers can append SQL after the LIMIT clause concatenated via QueryWrapper.last() to extract database contents using union-based or blind techniques.
- CVE-2023-36100Critical
An issue was discovered in IceCMS version 2.0.1, allowing attackers to escalate privileges and gain sensitive information via the UserID parameter in api/User/ChangeUser.
- CVE-2024-46607High
In IceCMS version 3.4.7 and earlier, an incorrect access control vulnerability exists in the loginAdmin method within UserController.java. Attackers can authenticate by entering arbitrary values as the username and password.
- CVE-2023-33356Medium
IceCMS version 1.0.0 is vulnerable to Cross Site Scripting (XSS) attacks, which may allow attackers to inject malicious code into the application.
- CVE-2023-33355High
IceCMS v1.0.0 has insecure permissions, leading to unauthorized access to the API and disclosure of sensitive information.
Original NVD description (English source)
IceCMS through 4.1.5 contains a missing authentication vulnerability that allows unauthenticated attackers to modify, delete, or disable any account because /User/** is excluded from the Shiro jwt filter. Attackers can send PUT requests to /User/updateUser to set a new password and role on any userId, including administrators, enabling full account takeover.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS