CVE-2026-4320: Creartia ICMS Authorization Bypass via HTTP Redirect Handling
CVE-2026-4320 is an authorization bypass in Creartia's ICMS software that can let an attacker reach protected features and escalate privileges without credentials by manipulating HTTP redirect behavior in the login process. INCIBE, the CNA, rates it critical with a CVSS 4.0 base score of 9.3. No KEV listing or confirmed exploitation appears in the sources consulted, and the record lists no affected or fixed versions.
Overview
CVE-2026-4320 describes an authorization bypass in Creartia's ICMS software. According to the record, an attacker can manipulate HTTP redirect headers during the login process so that the script keeps running, which may grant access to protected features and enable privilege escalation without credentials. The weakness is mapped to CWE-288, authentication bypass using an alternate path or channel.
Impact
- The record states that unauthorized access to protected features is possible.
- The record states that privilege escalation is possible without valid credentials.
- The base scoring data indicates high impact on confidentiality and integrity of the vulnerable system, and no impact on availability or on subsequent systems.
- INCIBE assigns a CVSS 4.0 base score of 9.3, and the record marks severity as critical.
Affected products and versions
The record identifies the product as Creartia's ICMS software but does not list any affected version ranges or fixed versions. Vendor and product details should be confirmed in the INCIBE notice.
Exploitation status
The record does not list this CVE in CISA's Known Exploited Vulnerabilities catalog. No confirmed exploitation appears in the sources consulted. The EPSS estimate in the record is a probability of 0.0043 with a percentile of 0.35492, which is an estimate and not evidence of exploitation.
Remediation and mitigation
- Check the INCIBE notice and the vendor channels for official patches or updates.
- Until a fix is verified, restrict access to login and administrative interfaces, for example through network segmentation or allowlisting of trusted sources.
- Prioritize this system given the critical rating, and validate any vendor update in a test environment before deployment.
- Review which protected features are exposed and reduce them where operationally possible.
Detection guidance
- Review web and authentication logs for requests to protected features that lack a valid authenticated session.
- Look for unusual redirect responses or access patterns on login endpoints.
- Monitor for newly created or changed privileged accounts.
Limitations of the available information
The record does not provide affected version ranges, fixed versions, vendor patch details or evidence of exploitation. The English title was missing from the source record and was written for this portal. The source status is listed as deferred, so the record may change as more information is published.
Frequently asked questions
What does CVE-2026-4320 allow an attacker to do?
According to the record, it can allow an attacker to gain unauthorized access to protected features of Creartia's ICMS software and escalate privileges without credentials, by manipulating HTTP redirect behavior in the login process.
Is CVE-2026-4320 known to be exploited?
The record does not list it in CISA's KEV catalog, and no confirmed exploitation appears in the sources consulted. The absence of such evidence does not prove that exploitation has not occurred.
This analysis was drafted with AI assistance from verified source data and automatically checked against it.