CVE-2026-4320: Creartia ICMS Auth Bypass Vulnerability

CVE-2026-4320 Overview

CVE-2026-4320 is an authorization bypass vulnerability in Creartia's ICMS content management software. Attackers can manipulate HTTP redirect headers during the login process to keep the script executing past authentication checks. This allows unauthorized access to protected features and enables privilege escalation without valid credentials. The flaw is classified under CWE-288: Authentication Bypass Using an Alternate Path or Channel. The vulnerability is exploitable over the network with no authentication, no user interaction, and low attack complexity.

Critical Impact
Unauthenticated remote attackers can bypass authorization controls in ICMS and escalate privileges without credentials, gaining access to protected functionality and sensitive data.

Affected Products

Creartia ICMS (Internet Consulting Management System) content management software
Specific affected versions are not enumerated in the published advisory
See the INCIBE Security Notice for vendor-confirmed scope

Discovery Timeline

2026-05-18 - CVE-2026-4320 published to NVD
2026-05-18 - Last updated in NVD database

Technical Details for CVE-2026-4320

Vulnerability Analysis

The vulnerability resides in the login workflow of Creartia's ICMS. The login script issues an HTTP redirect when authentication fails or when access controls would otherwise restrict the user. However, the script does not terminate execution after sending the redirect headers. As a result, the server continues processing the request and serves protected content or performs privileged actions in the same response cycle.

An attacker who intercepts or simply ignores the redirect on the client side receives the full response body and any state changes the script performed. This breaks the authorization boundary the redirect was intended to enforce. Because the bypass requires no credentials and no user interaction, an unauthenticated remote attacker can reach administrative functionality directly.

Root Cause

The root cause is missing flow termination after an HTTP redirect, mapped to [CWE-288]. PHP-style web applications must call an explicit exit or die after emitting a Location: header. Without that termination, the redirect is advisory only and downstream code that assumes a successful authentication state executes anyway.

Attack Vector

Exploitation occurs over the network against the ICMS login endpoint. An attacker issues a request to a protected resource, observes the redirect response, and parses the body of the same response for sensitive data or uses the side effects of the executed code path. Tools such as curl --no-location or any HTTP client that does not auto-follow redirects are sufficient. No specialized exploit tooling is required.

No public proof-of-concept code is available for this CVE. Refer to the INCIBE Security Notice for vendor-coordinated technical details.

Detection Methods for CVE-2026-4320

Indicators of Compromise

HTTP requests to ICMS login or administrative endpoints that receive 3xx redirect responses with non-empty response bodies containing protected content
Access log entries showing successful retrieval of admin-only resources from clients that never completed an authenticated session
Anomalous use of HTTP clients that do not follow redirects, such as curl with --no-location, targeting login URLs

Detection Strategies

Inspect web server access logs for 3xx responses where the Content-Length is greater than the size of a typical redirect page
Correlate authentication failures with subsequent successful access to privileged endpoints from the same source IP within the same session
Deploy web application firewall rules that flag requests to protected ICMS paths originating from unauthenticated sessions

Monitoring Recommendations

Enable verbose logging on the ICMS application tier to capture session state at the point of redirect emission
Alert on privileged action audit events that lack a corresponding successful login event
Monitor outbound data volumes from the ICMS host for unexpected spikes that may indicate bulk data extraction

How to Mitigate CVE-2026-4320

Immediate Actions Required

Restrict network access to ICMS administrative endpoints to trusted IP ranges or via VPN until a patch is applied
Place the ICMS application behind a web application firewall configured to block unauthenticated access to protected paths
Review application and access logs for prior exploitation indicators dating back to the deployment of the affected version

Patch Information

Consult the INCIBE Security Notice for vendor patch availability and upgrade instructions. Contact Creartia directly for fixed builds of ICMS if a patch is not yet listed.

Workarounds

Add an explicit script termination immediately after every authentication-related Location: header in custom or themeable ICMS code paths
Enforce server-side session validation on every protected endpoint independent of redirect behavior
Disable or remove unused administrative modules to reduce the exposed attack surface