Live › vulnerability › CVE-2026-112295
Go to dashboardFlyCms through commit edfdf724 accepts extra User fields on the /ucenter/account_update endpoint, so a logged-in user can overwrite protected account columns. An attacker can change their own review status or username, or copy another account's username, email or mobile to lock that victim out of their login.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Sites running FlyCms at or before commit edfdf724 that let registered users reach the account update endpoint. Installations with no user registration or no public account area are less exposed, since the attacker needs a login first. The sources do not name a fixed version or commit.
No product ranges from the sources yet.
edfdf724 or earlier, for example with git log --oneline | grep edfdf724 in the FlyCms checkout/ucenter/account_update to see whether it binds the whole User bean without an allow-list of fieldsUnknown from the sources.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
FlyCms through commit edfdf724 contains a mass assignment vulnerability that allows authenticated users to overwrite protected account columns by submitting extra User bean fields to /ucenter/account_update. Attackers can change their review status, rename themselves, or duplicate another account's username, email or mobile to break that victim's login.
This page as .md · .json · in your agent: get_signal("CVE-2026-112295")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.