Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
7.6
CVE-2026-112295: FlyCMS lets logged‑in users change other users’ login details
CVE-2026-112295 · published 16 days ago
Summary
In FlyCMS, a flaw lets someone who is already signed in add extra data when updating their account, which can overwrite important fields like username, email or phone number. This could let an attacker rename themselves, alter their review status, or copy another person’s login information, potentially locking the real user out. Upgrade to a patched version of FlyCMS or apply the vendor’s recommended fix and ensure only the intended fields can be updated.
What to do
The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.
Affected software
| Vendor | Product | Affected versions |
|---|---|---|
| sunkaifei | flycms | <= edfdf724c3b944310f60c29aa755d03a00a75837 |
Original advisory text
FlyCms through commit edfdf724 Mass Assignment via /ucenter/account_update
FlyCms through commit edfdf724 contains a mass assignment vulnerability that allows authenticated users to overwrite protected account columns by submitting extra User bean fields to /ucenter/account_update. Attackers can change their review status, rename themselves, or duplicate another account's username, email or mobile to break that victim's login.
References
- https://github.com/sunkaifei/FlyCms/issues/19 Third Party Advisory
- https://github.com/sunkaifei/FlyCms/blob/edfdf724c3b944310f60c29aa755d03a00a7583... Third Party Advisory
- https://github.com/sunkaifei/FlyCms/blob/edfdf724c3b944310f60c29aa755d03a00a7583... Third Party Advisory
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/112xxx/CVE-2026-1122... Vendor Advisory
- https://nvd.nist.gov/vuln/detail/CVE-2026-112295 Vendor Advisory
- https://github.com/sunkaifei/FlyCms Product
- https://www.vulncheck.com/advisories/flycms-through-commit-edfdf724-mass-assignm... Vendor Advisory
- https://github.com/sunkaifei/FlyCms/blob/edfdf724c3b944310f60c29aa755d03a00a7583... Third Party Advisory
Internet-facing
60 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit
- Gives an attacker partial control
Severity
7.6
High
Type
CWE-915Improperly Controlled Modification of Dynamically-Determined Object Attributes
Timeline
Published19 Oct 2026
Updated4 Nov 2026
First seen19 Oct 2026
Track software like this
Free during beta