by Kastro
Paper/Archive/CVE-2026-4320

CVE-2026-4320

Creartia Internet Consulting ICMS Content Management — Authorization Bypass in ICMS Content Management by Creartia Internet Consulting

EPSS 0.3%CVSS 9.3
critical.is priorityof 100
31
CVSS 9.3 (CNA)9.3 / 10 × 3027.9Not in CISA KEV+300.0EPSS percentile 17.0.170 × 203.4No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

Authorization Bypass vulnerability in Creartia's ICMS software could allow an attacker to gain unauthorized access to protected features by manipulating the HTTP redirect headers of the login process, causing the script to continue running and enabling privilege escalation without the need for credentials.

Affected

ProductAffectedFixed inSource
ICMS Content Managementall versions–CNA

Scores by source

INCIBE (CNA)9.3CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N
CISA ADPSSVCExploitation: none · Automatable: yes · Technical impact: total

References

patchincibe.es/en/incibe-cert/notices/aviso/authorization-bypass-icms-content-management-creartia-internet-consulting