This vulnerability (CVE-2026-4320) in Creartia's ICMS Content Management software involves an authorization bypass (CWE-288) where an attacker can manipulate HTTP redirect headers in the login process. This manipulation causes the authentication script to continue running without proper credential verification, enabling privilege escalation to protected features. The CVSS 4.0 score of 9.3 reflects network attack vector, low attack complexity, no privileges or user interaction required, and high impact on confidentiality and integrity. No patch or official remediation level has been published by the vendor as of the current data.

Successful exploitation allows an unauthenticated attacker to gain unauthorized access to protected features and escalate privileges within the ICMS software. This can lead to compromise of sensitive data and administrative functions without requiring valid credentials. The critical CVSS score indicates a severe impact on confidentiality and integrity of the affected system.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider restricting access to the ICMS login interface and monitor for suspicious activity related to HTTP redirects. Avoid relying solely on HTTP redirect headers for authentication decisions.