---
id: "CVE-2026-112294"
kind: "vulnerability"
aliases: ["CVE-2026-112294"]
title: "FlyCms: any registered user can alter other users' numeric content fields"
severity: "medium"
cvss: 5.3
epss: null
exploited: false
status: "open"
category: "other"
products: []
ecosystems: []
tags: ["flycms", "other", "php", "self-hosted"]
not_affected_if: ["auth-required", "no-open-registration"]
published_at: "2026-10-19T14:17:08+00:00"
first_seen_at: "2026-10-23T21:57:18+00:00"
updated_at: "2026-10-25T04:25:06+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-112294", "first_seen_at": "2026-10-23T21:57:18+00:00"}]
---

# FlyCms: any registered user can alter other users' numeric content fields

FlyCms, a PHP content management system, fails to verify row ownership in ActionService.counter(), so any logged-in user can change other users' records. An attacker can add arbitrary deltas to numeric fields such as price, stock or points by calling the counter or compose endpoints under /ucenter/action/.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Look for `ActionService.counter()` and the `checkRowOwner` call in the FlyCms source at or before commit `edfdf724`.
- Test whether a regular account can POST to `/ucenter/action/{modelCode}/{id}/counter` against a row it does not own.
- unknown for a version-number check, since the sources only name a commit.

## Fix

- unknown: the sources do not name a fixed commit or release.
- Until a patched version is available, restrict write access to the `/ucenter/action/` routes to trusted roles.

## Timeline

- 2026-10-23T21:57:18+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-112294

## From the sources

FlyCms through commit edfdf724 contains a missing authorization vulnerability in ActionService.counter() that allows authenticated users to modify other users' content rows because checkRowOwner never verifies ownership. Any registered user can send requests to /ucenter/action/{modelCode}/{id}/counter or /ucenter/action/compose to add arbitrary deltas to numeric fields like price, stock, or points.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_