Skip to content

CVE record · 1 source

CVE-2026-111673

CVSS 9.8

IceCMS through 4.1.5 contains a missing authentication vulnerability that allows unauthenticated attackers to modify, delete, or disable any account…

Vendor: Apache Software Foundation
Product: Shiro
CVSS: 9.8
EPSS: 0.005 (p46)
Exposure class: Identity

Coverage

1

Every item in the archive that references this CVE, highest rank first. Headlines open the publisher.

30

CVE NVD 15d ago

IceCMS through 4.1.5 contains a missing authentication vulnerability that allows unauthenticated attackers to modify, delete, or disable any account…

IceCMS through 4.1.5 contains a missing authentication vulnerability that allows unauthenticated attackers to modify, delete, or disable any account because /User/** is excluded from the Shiro jwt filter. Attackers can send PUT…

CVSS 9.8 CVE-2026-111673 Apache Software Foundation