External risk intelligence

IceCMS Missing Authentication Allows Account Takeover

CVE advisorySeverity: CRITICAL (CVSS 9.3)

CVE-2026-111673

IceCMS is a content management system. CMS platforms are commonly deployed as internet-facing web applications to manage website content, making their administrative and user-facing API endpoints typically accessible from the public internet.

Missing Authentication

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A critical vulnerability exists in IceCMS technology that allows unauthenticated attackers to take over any user account, including administrators. This occurs because certain user management functions are not properly protected, enabling unauthorized modification of passwords and roles. The main concern is confirming relevance and exposure.

Unauthenticated users can take over any account.
This allows unauthorized changes to user accounts.
Confirm if our organization uses this software.

Attack Path

How an attacker could exploit the issue

An attacker can target the IceCMS system by leveraging its public-facing user management features. By sending a specially crafted PUT request to the `/User/updateUser` endpoint, an attacker can modify any user's account, including administrative ones, without needing any prior authentication. This allows them to reset passwords and assign new roles, ultimately leading to a complete takeover of user accounts within the system.

No authentication is required to access user endpoints.
Attacker sends PUT request to `/User/updateUser`.
Risk of unauthenticated account takeover.

Live Threat

Current exploitation, exposure, and threat context

When supported by the advisory, this vulnerability could allow unauthenticated attackers to take over any account, including administrative ones, by sending crafted requests to update user information. This could lead to unauthorized modification or deletion of account data and service disruption.

User accounts and administrative privileges.
Unauthenticated requests to update user data.
Full account takeover and service disruption.

Operational Fix

Recommended remediation, mitigation, and detection steps

The real-world ownership for this vulnerability likely falls to the application owners responsible for IceCMS, potentially in collaboration with infrastructure or platform teams managing its deployment. The first practical step is to identify all instances of IceCMS, confirm their exposure and business criticality, and then locate the accountable owner to prioritize remediation planning.

Application owners should own this issue.
Verify IceCMS instances and exposure.
Plan remediation based on identified risk.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is IceCMS?

IceCMS is a content management system used to build and manage website content. It provides administrative features and API endpoints to handle user accounts, roles, and site data. Because it is designed to manage web content, it is often deployed on servers where it must remain reachable to perform its core functions.

What does CWE-306 mean for CVE-2026-111673?

CWE-306 refers to a missing authentication for a critical function. In the context of this CVE, it means the software performs sensitive operations—such as modifying user passwords or changing account roles—without verifying the identity of the person making the request. This allows anyone to interact with these administrative actions as if they were a logged-in user.

How can an attacker trigger this vulnerability?

An attacker can exploit this by sending a specially crafted PUT request directly to the /User/updateUser endpoint. This path bypasses the security filters intended to restrict access. It is important to note that this flaw does not require the attacker to have an existing account, legitimate credentials, or any prior interaction with the system to perform these unauthorized modifications.

Do I need to worry if my IceCMS instance is internal?

Halo Surface Signal notes that CMS platforms are typically deployed as internet-facing applications, which increases the likelihood of exposure. However, if your specific instance is strictly hosted on an internal network, it is less accessible to external attackers. You should verify your deployment's reachability to determine how easily an attacker could route requests to these sensitive endpoints.

When should I take action for this vulnerability?

You should prioritize this immediately if you identify IceCMS instances in your environment. First, work with the relevant application owners to confirm the software version and verify if the affected endpoints are reachable. Once confirmed, coordinate with your team to plan remediation steps, as this flaw allows for the complete takeover of administrative accounts.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.