CVE-2026-4320
published 2026-05-18CVE-2026-4320: Authorization Bypass vulnerability in Creartia's ICMS software could allow an attacker to gain unauthorized access to protected features by manipulating the…
PriorityP260critical9.3CVSS 4.0
AVNACLATNPRNUINVCHVIHVANSCNSINSANEXCRXIRXARXMAVXMACXMATXMPRXMUIXMVCXMVIXMVAXMSCXMSIXMSAXSXAUXRXVXREXUX
EPSS
0.25%
16.7th percentile
Authorization Bypass vulnerability in Creartia's ICMS software could allow an attacker to gain unauthorized access to protected features by manipulating the HTTP redirect headers of the login process, causing the script to continue running and enabling privilege escalation without the need for credentials.
Affected
1 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| creartia_internet_consulting | icms_content_management | < * | * |
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
VulDB
Creartia Internet Consulting ICMS Content Management HTTP Redirect authentication bypass (EUVD-2026-30762)
vuldb·2026-05-18·CVSS 9.3
CVE-2026-4320 [CRITICAL] Creartia Internet Consulting ICMS Content Management HTTP Redirect authentication bypass (EUVD-2026-30762)
A vulnerability identified as critical has been detected in Creartia Internet Consulting ICMS Content Management. This affects an unknown function of the component HTTP Redirect Handler. This manipulation causes authentication bypass using alternate channel.
This vulnerability is handled as CVE-2026-4320. The attack can be initiated remotely. There is not any exploit available.
GHSA
GHSA-gg2r-86qc-9w57: Authorization Bypass vulnerability in Creartia's ICMS software could allow an attacker to gain unauthorized access to protected features by manipulati
ghsa_unreviewed·2026-05-18
CVE-2026-4320 [CRITICAL] CWE-288 GHSA-gg2r-86qc-9w57: Authorization Bypass vulnerability in Creartia's ICMS software could allow an attacker to gain unauthorized access to protected features by manipulati
Authorization Bypass vulnerability in Creartia's ICMS software could allow an attacker to gain unauthorized access to protected features by manipulating the HTTP redirect headers of the login process, causing the script to continue running and enabling privilege escalation without the need for credentials.
No detection rules found.
No public exploits indexed.
2026-05-18
Published