PT-2026-41665 · Unknown · Creartia Icms

Pirolita · Published 2026-05-18 · Updated 2026-05-18 · CVE-2026-4320

Positive Technologies (AI Summary)

CVSS v4.0

9.3

Critical

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Name of the Vulnerable Software and Affected Versions Creartia ICMS (affected versions not specified)

Description An authorization bypass exists that allows an attacker to gain unauthorized access to protected features. This is achieved by manipulating the HTTP redirect headers during the login process, which causes the script to continue execution and enables privilege escalation without requiring credentials.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

LPE

Authentication Bypass Using an Alternate Path or Channel

Weakness Enumeration

CWE-288

Related Identifiers

CVE-2026-4320

Affected Products

Creartia Icms

References · 6

• https://incibe.es/en/incibe-cert/notices/aviso/authorization-bypass-icms-content-management-creartia-internet-consulting · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2026-4320 · Security Note
• https://twitter.com/VulmonFeeds/status/2056368951492255931 · Twitter Post
• https://t.me/cveNotify/163827 · Telegram Post
• https://t.me/CVEtracker/54126 · Telegram Post
• https://twitter.com/CVEarity/status/2056408397944381789 · Twitter Post