{"id":"CVE-2026-112294","kind":"vulnerability","aliases":["CVE-2026-112294"],"related":[],"title":"FlyCms: any registered user can alter other users' numeric content fields","description":"FlyCms through commit edfdf724 contains a missing authorization vulnerability in ActionService.counter() that allows authenticated users to modify other users' content rows because checkRowOwner never verifies ownership. Any registered user can send requests to /ucenter/action/{modelCode}/{id}/counter or /ucenter/action/compose to add arbitrary deltas to numeric fields like price, stock, or points.","summary":"FlyCms, a PHP content management system, fails to verify row ownership in ActionService.counter(), so any logged-in user can change other users' records. An attacker can add arbitrary deltas to numeric fields such as price, stock or points by calling the counter or compose endpoints under /ucenter/action/.","severity":"medium","cvss":5.3,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["flycms","other","php","self-hosted"],"not_affected_if":["auth-required","no-open-registration"],"how_to_check":"- Look for `ActionService.counter()` and the `checkRowOwner` call in the FlyCms source at or before commit `edfdf724`.\n- Test whether a regular account can POST to `/ucenter/action/{modelCode}/{id}/counter` against a row it does not own.\n- unknown for a version-number check, since the sources only name a commit.","fix":"- unknown: the sources do not name a fixed commit or release.\n- Until a patched version is available, restrict write access to the `/ucenter/action/` routes to trusted roles.","status":"open","published_at":"2026-10-19T14:17:08+00:00","first_seen_at":"2026-10-23T21:57:18+00:00","triaged_at":"2026-10-25T04:25:06+00:00","updated_at":"2026-10-25T04:25:06+00:00","category":"other","confidence":0.6,"triage":{"at":"2026-10-25T04:25:06Z","model":"claude-haiku-5-5","output":{"fix":"- unknown: the sources do not name a fixed commit or release.\n- Until a patched version is available, restrict write access to the `/ucenter/action/` routes to trusted roles.","reach":"internet","title":"FlyCms: any registered user can alter other users' numeric content fields","impact":"medium","summary":"FlyCms, a PHP content management system, fails to verify row ownership in ActionService.counter(), so any logged-in user can change other users' records. An attacker can add arbitrary deltas to numeric fields such as price, stock or points by calling the counter or compose endpoints under /ucenter/action/.","category":"other","nicknames":[],"who_cares":["php","flycms","self-hosted"],"confidence":0.6,"needs_auth":"yes","worst_case":"Authenticated users alter other users' numeric records, such as prices and stock.","analyst_note":"Find the FlyCms fixed commit or release and confirm which ucenter action routes are reachable by default.","how_to_check":"- Look for `ActionService.counter()` and the `checkRowOwner` call in the FlyCms source at or before commit `edfdf724`.\n- Test whether a regular account can POST to `/ucenter/action/{modelCode}/{id}/counter` against a row it does not own.\n- unknown for a version-number check, since the sources only name a commit.","needs_analyst":true,"not_affected_if":["auth-required","no-open-registration"],"who_is_affected":"Sites running FlyCms at or before commit `edfdf724` where ordinary registered users can log in, since the flaw needs an authenticated account. Installations without open user registration, or that have not exposed the ucenter action routes, are less exposed. The sources do not say which configurations are affected beyond that.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000652,"input_tokens":3356,"output_tokens":632,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-112294':14A,17A '-2026':13A,16A '/counter':108C '/ucenter/action':71B,105C '/ucenter/action/compose':110C 'actionservice.counter':36B,82C 'add':51B,112C 'allow':84C 'alter':6A 'arbitrari':52B,113C 'attack':49B 'authent':85C 'author':79C 'call':64B 'chang':44B 'checkrowown':94C 'commit':74C 'compos':68B 'contain':76C 'content':10A,27B,91C 'counter':66B 'cve':12A,15A 'delta':53B,114C 'edfdf724':75C 'endpoint':69B 'fail':30B 'field':11A,56B,117C 'flycm':1A,18B,24B,72C 'host':23B 'id':107C 'like':118C 'log':40B 'logged-in':39B 'manag':28B 'miss':78C 'modelcod':106C 'modifi':88C 'never':95C 'numer':9A,55B,116C 'ownership':34B,97C 'php':20B,26B 'point':62B,122C 'price':59B,119C 'record':47B 'regist':3A,99C 'request':103C 'row':33B,92C 'self':22B 'self-host':21B 'send':102C 'stock':60B,120C 'system':29B 'user':4A,8A,42B,46B,86C,90C,100C 'verifi':32B,96C 'vulner':80C","nicknames":[],"mitigations":[],"who_affected":"Sites running FlyCms at or before commit `edfdf724` where ordinary registered users can log in, since the flaw needs an authenticated account. Installations without open user registration, or that have not exposed the ucenter action routes, are less exposed. The sources do not say which configurations are affected beyond that.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-19T14:17:08+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-112294","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-112294","severity":null,"published_at":"2026-10-19T14:17:08+00:00","modified_at":"2026-10-19T21:14:14+00:00","first_seen_at":"2026-10-23T21:57:18+00:00","fetched_at":"2026-10-23T22:28:57+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}