CVE-2026-4320
CWE-288Published: May 18, 2026· Updated: May 18, 2026
Official Description
Authorization Bypass vulnerability in Creartia's ICMS software could allow an attacker to gain unauthorized access to protected features by manipulating the HTTP redirect headers of the login process, causing the script to continue running and enabling privilege escalation without the need for credentials.
Risk Analysis
This critical authorization bypass vulnerability in Creartia's ICMS software allows an attacker to gain unauthorized access to protected features. By manipulating HTTP redirect headers during the login process, an attacker can achieve privilege escalation without credentials. With a CVSS score of 9.3, this is a serious concern.
No public exploit is currently known for this vulnerability. The flaw is remotely exploitable and requires no authentication.
Implement robust validation of HTTP redirect headers and ensure that authentication checks are strictly enforced throughout the login process. Apply any available patches or updates from Creartia for their ICMS software.
Technical Analysis
CVE-2026-4320 can be exploited remotely over the network without requiring physical or adjacent access, significantly expanding the attack surface for threat actors.
The vulnerability requires no privileges and no user interaction, making it a prime target for automated exploitation campaigns and worm-like propagation.
CVSS v3.1 Vector Breakdown
Exploit & PoC Resources
All References (1)
Quick Facts
Related CVEs (CWE-288)
Recommended Actions
- →Apply vendor patches immediately
- →Monitor CVE-2026-4320 in threat intel feeds
- →Review IDS/IPS signatures for exploitation attempts