Live › vulnerability › CVE-2026-112294
Go to dashboardFlyCms, a PHP content management system, fails to verify row ownership in ActionService.counter(), so any logged-in user can change other users' records. An attacker can add arbitrary deltas to numeric fields such as price, stock or points by calling the counter or compose endpoints under /ucenter/action/.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Sites running FlyCms at or before commit edfdf724 where ordinary registered users can log in, since the flaw needs an authenticated account. Installations without open user registration, or that have not exposed the ucenter action routes, are less exposed. The sources do not say which configurations are affected beyond that.
No product ranges from the sources yet.
ActionService.counter() and the checkRowOwner call in the FlyCms source at or before commit edfdf724./ucenter/action/{modelCode}/{id}/counter against a row it does not own./ucenter/action/ routes to trusted roles.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
FlyCms through commit edfdf724 contains a missing authorization vulnerability in ActionService.counter() that allows authenticated users to modify other users' content rows because checkRowOwner never verifies ownership. Any registered user can send requests to /ucenter/action/{modelCode}/{id}/counter or /ucenter/action/compose to add arbitrary deltas to numeric fields like price, stock, or points.
This page as .md · .json · in your agent: get_signal("CVE-2026-112294")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.