Key points
- Thecosy IceCMS versions through 4.1.5 are affected by CVE-2026-111673, rated CVSS 9.3 Critical.
- Attackers can send unauthenticated PUT requests to modify or disable any user account, including administrators.
- The flaw exists because the /User/** path is excluded from the Shiro JWT security filter.
Thecosy IceCMS software versions up to and including 4.1.5 contain a critical security vulnerability that exposes user accounts to unauthorized modification. The National Vulnerability Database lists the issue as CVE-2026-111673 with a CVSS score of 9.3. This rating indicates a severe risk where unauthenticated attackers can gain full control over administrative functions without needing valid login credentials.
In plain English
The vulnerability stems from a configuration error in the application's security filters. Specifically, the Shiro JWT filter does not protect the /User/** directory paths. This oversight allows anyone with internet access to the server to send specific HTTP PUT requests to the /User/updateUser endpoint. By targeting this endpoint, an attacker can change the password and role of any user ID known to exist within the system.
The background
This flaw is classified under CWE-306, which refers to missing authentication for critical functions. According to the NVD record, the issue enables attackers to modify, delete, or disable any account within the IceCMS platform. Because the vulnerability allows changes to administrator roles, it effectively grants an attacker complete takeover of the content management system. The flaw affects all deployments of IceCMS running version 4.1.5 or any earlier release from Thecosy.
What changes now
Organizations using IceCMS must verify their current software version immediately. If the system is running 4.1.5 or older, it is vulnerable to remote exploitation. Since the source material does not confirm the release of a patched version, administrators should assume the risk remains active. Users should monitor official channels from Thecosy for announcements regarding updated software versions that address CVE-2026-111673 and the associated CWE-306 weakness.
Who needs to act first
Teams managing public-facing IceCMS instances should prioritize immediate exposure reduction. Since no vendor patch is confirmed, focus on network-level controls to block unauthorized access. Check whether web application firewalls can restrict PUT requests to the user update endpoints. Ensure that administrative interfaces are not directly accessible from the public internet.
Review server logs for unusual activity patterns that might indicate exploitation attempts. Isolate affected systems from critical business networks if possible. Prepare an incident response plan that assumes potential compromise of administrative credentials. Verify that backup systems are secure and separate from the vulnerable production environment.
Background: Incident response plans
A cybersecurity incident response plan example provides a written sequence of actions for detecting, containing, and recovering from a security breach. It assigns specific roles, defines communication channels, and outlines technical steps to limit damage. This document reduces panic and ensures consistent handling of threats like phishing or malware outbreaks.
Read the full guide: Cybersecurity Incident Response Plan Example and Structure
What to do and how to stay safe: IceCMS
- Verify if your IceCMS installation is version 4.1.5 or earlier by checking the software dashboard or release notes.
- Restrict network access to the /User/updateUser endpoint using firewall rules or web application firewall policies.
- Monitor server logs for unauthenticated PUT requests targeting user management paths, which may indicate exploitation.
- Change all administrative passwords and review user roles once a verified patch from Thecosy is released.
Step-by-step guide: Account Takeover Prevention Checklist for Secure Systems
General security guidance from the Patch Herald newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Which versions of IceCMS are vulnerable to this flaw?
All versions of Thecosy IceCMS up to and including 4.1.5 are affected by the missing authentication vulnerability.
What can an attacker do with this vulnerability?
Attackers can modify, delete, or disable any account, including administrators, by sending unauthenticated PUT requests.
Is there a confirmed fix for CVE-2026-111673?
The source material does not confirm that a patch or updated version fixing this vulnerability is currently available.
