IceCMS through version 4.1.5 contains a missing authentication flaw that allows attackers to modify, delete, or disable any user account, including administrators. The vulnerability arises because the /User administrative endpoints are excluded from the Shiro JWT filter, so no identity verification is performed before processing the requests. An attacker who can send HTTP PUT requests to /User/updateUser can set a new password and role on any userId, effectively taking full control of that account. This results in a complete compromise of the user’s access credentials, allowing the attacker to access, alter, or misuse any system functions available to that account.

Thecosy’s IceCMS product, up to and including version 4.1.5, is affected by this flaw. All instances of IceCMS that have not applied a post‑4.1.5 fix are vulnerable and should be considered at risk.

The CVSS score of 9.3 indicates critical severity, and the lack of a validated EPSS score means there is no proven public exploitation yet. The vulnerability is not listed in CISA’s KEV catalog. The attack is performed remotely over the network by sending unauthenticated HTTP requests; no user interaction or special privileges are required. Once executed, the attacker can change any user’s credentials and roles, leading to full account takeover with no further exploitation steps needed.