EUVD-2026-30762
GHSA-gg2r-86qc-9w57
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessSend HTTP request with crafted redirect headers
-
DeliveryBypass authentication check in login script
-
ExploitGain unauthorized access to admin features
-
ExecutionEscalate privileges
-
ImpactAccess or modify protected content
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A07:2025 - Authentication Failures
ASVS 5.0
V6 - Authentication Alternate path authentication
|
| Exploitation Conditions | No special conditions - remote unauthenticated exploitation against default configurations of ICMS. The vulnerability exists in the core login process which is exposed by default in any ICMS deployment accessible over the network. No specific features need to be enabled or configured. The only requirement is network accessibility to the ICMS login interface, making any internet-facing or internally accessible ICMS instance vulnerable unless patched. |
| Impact | The CVSS 4.0 score of 9.3 indicates critical severity with network vector (AV:N), low complexity (AC:L), no privileges required (PR:N), and no user interaction (UI:N). High impacts to confidentiality (VC:H) and integrity (VI:H) confirm attackers can both read sensitive data and modify system state. The availability impact is none (VA:N), suggesting no denial of service. No EPSS score or KEV listing is provided, indicating no confirmed active exploitation at time of analysis. The combination of remote unauthenticated access and privilege escalation makes this a high-priority patch target for any organization using ICMS. |
| Exploit ScenarioDerived | An attacker sends a specially crafted HTTP request to the ICMS login page with manipulated redirect headers. The authentication check is bypassed as the script continues processing despite the redirect, granting the attacker administrative access without valid credentials. From there, the attacker can access sensitive content, modify system configuration, or create new privileged accounts. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – May 18, 2026
Authorization bypass in Creartia's ICMS content management system allows remote unauthenticated attackers to gain unauthorized access to protected features and escalate privileges by manipulating HTTP redirect headers during the login process. The vulnerability has a CVSS 9.3 score and vendor patches are available through INCIBE advisory.
RemediationAI
Apply the vendor patch available through the INCIBE advisory at https://www.incibe.es/en/incibe-cert/notices/aviso/authorization-bypass-icms-content-management-creartia-internet-consulting. The advisory confirms patches are available but does not specify exact fixed version numbers. As an interim mitigation, restrict network access to the ICMS login interface to trusted IP ranges only, though this may impact legitimate remote users. Monitor authentication logs for suspicious redirect manipulation attempts. Consider implementing a Web Application Firewall rule to detect and block requests with malformed redirect headers targeting the login endpoint.
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The vulnerability affects Creartia Internet Consulting's ICMS (Internet Content Management System) software, identified by CPE cpe:2.3:a:creartia_internet_consulting:icms_content_management. The root cause is CWE-288 (Authentication Bypass Using an Alternate Path or Channel), where the application fails to properly validate authentication state after processing redirect headers. When login redirect headers are manipulated, the authentication script continues execution despite the redirect, allowing attackers to bypass authentication checks and access protected functionality.
Know when Icms Content Management gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N
Primary rating from Vendor (INCIBE) · only source for this CVE.
CVSS VectorVendor: INCIBE
DescriptionCVE.org
Authorization Bypass vulnerability in Creartia's ICMS software could allow an attacker to gain unauthorized access to protected features by manipulating the HTTP redirect headers of the login process, causing the script to continue running and enabling privilege escalation without the need for credentials.
Executive ViewAI
CVE-2026-4320 is a critical authorization bypass in Creartia ICMS that allows unauthenticated attackers to bypass login controls and escalate privileges by exploiting redirect header manipulation. This directly threatens confidentiality and integrity of all content managed within the system, potentially exposing sensitive data and enabling unauthorized modifications across the platform.
Apply vendor patch. If immediate patching is not feasible, implement network-level access controls to restrict ICMS login endpoints to trusted IP ranges and enable enhanced logging on authentication and privilege escalation events to detect exploitation attempts.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Privilege escalation occurs when an attacker leverages flaws in access control mechanisms to gain permissions beyond what they were originally granted.
Exploit-DB