The vulnerability results from manipulation of HTTP redirect headers during the login process. By tampering with these headers, an attacker can cause the script to continue executing after authentication, thereby gaining unauthorized access to protected features without needing valid credentials. This represents a direct authorization bypass, classified as CWE-288.

Creartia Internet Consulting’s ICMS Content Management software is affected. No specific version numbers are supplied; administrators should check for the most recent release that contains the fix.

The CVSS score is 9.3, indicating critical severity. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog. The attack vector is inferred to be remote and requires the attacker to send a crafted HTTP request that alters redirect headers during the login sequence. Once exploited, the attacker can elevate privileges and access sensitive functionality without authentication.