{"id":"CVE-2026-112295","kind":"vulnerability","aliases":["CVE-2026-112295"],"related":[],"title":"FlyCms: account update lets users overwrite protected account fields","description":"FlyCms through commit edfdf724 contains a mass assignment vulnerability that allows authenticated users to overwrite protected account columns by submitting extra User bean fields to /ucenter/account_update. Attackers can change their review status, rename themselves, or duplicate another account's username, email or mobile to break that victim's login.","summary":"FlyCms through commit edfdf724 accepts extra User fields on the /ucenter/account_update endpoint, so a logged-in user can overwrite protected account columns. An attacker can change their own review status or username, or copy another account's username, email or mobile to lock that victim out of their login.","severity":"medium","cvss":5.4,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["flycms","other","php","self-hosted"],"not_affected_if":["auth-required","no-public-registration"],"how_to_check":"- Check whether the deployed FlyCms code includes commit `edfdf724` or earlier, for example with `git log --oneline | grep edfdf724` in the FlyCms checkout\n- Review the account update handler behind `/ucenter/account_update` to see whether it binds the whole User bean without an allow-list of fields","fix":null,"status":"open","published_at":"2026-10-19T14:17:08+00:00","first_seen_at":"2026-10-23T21:57:18+00:00","triaged_at":"2026-10-25T04:16:46+00:00","updated_at":"2026-10-25T04:16:46+00:00","category":"other","confidence":0.6,"triage":{"at":"2026-10-25T04:16:46Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"FlyCms: account update lets users overwrite protected account fields","impact":"medium","summary":"FlyCms through commit edfdf724 accepts extra User fields on the /ucenter/account_update endpoint, so a logged-in user can overwrite protected account columns. An attacker can change their own review status or username, or copy another account's username, email or mobile to lock that victim out of their login.","category":"other","nicknames":[],"who_cares":["flycms","self-hosted","php"],"confidence":0.6,"needs_auth":"yes","worst_case":"Users can take over other accounts' login identifiers and alter their own review status.","analyst_note":"Find a fixed FlyCms release or commit and the exact fix to the account update binding; the NVD entry does not give one.","how_to_check":"- Check whether the deployed FlyCms code includes commit `edfdf724` or earlier, for example with `git log --oneline | grep edfdf724` in the FlyCms checkout\n- Review the account update handler behind `/ucenter/account_update` to see whether it binds the whole User bean without an allow-list of fields","needs_analyst":true,"not_affected_if":["auth-required","no-public-registration"],"who_is_affected":"Sites running FlyCms at or before commit edfdf724 that let registered users reach the account update endpoint. Installations with no user registration or no public account area are less exposed, since the attacker needs a login first. The sources do not name a fixed version or commit.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000606,"input_tokens":3327,"output_tokens":546,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-112295':12A,15A '-2026':11A,14A '/ucenter/account_update':32B,97C 'accept':26B 'account':2A,8A,43B,58B,88C,109C 'allow':82C 'anoth':57B,108C 'assign':79C 'attack':46B,98C 'authent':83C 'bean':94C 'break':116C 'chang':48B,100C 'column':44B,89C 'commit':24B,74C 'contain':76C 'copi':56B 'cve':10A,13A 'duplic':107C 'edfdf724':25B,75C 'email':61B,112C 'endpoint':33B 'extra':27B,92C 'field':9A,29B,95C 'flycm':1A,16B,22B,72C 'host':21B 'let':4A 'lock':65B 'log':37B 'logged-in':36B 'login':71B,120C 'mass':78C 'mobil':63B,114C 'overwrit':6A,41B,86C 'php':18B 'protect':7A,42B,87C 'renam':104C 'review':51B,102C 'self':20B 'self-host':19B 'status':52B,103C 'submit':91C 'updat':3A 'user':5A,28B,39B,84C,93C 'usernam':54B,60B,111C 'victim':67B,118C 'vulner':80C","nicknames":[],"mitigations":[],"who_affected":"Sites running FlyCms at or before commit edfdf724 that let registered users reach the account update endpoint. Installations with no user registration or no public account area are less exposed, since the attacker needs a login first. The sources do not name a fixed version or commit.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-19T14:17:08+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-112295","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-112295","severity":null,"published_at":"2026-10-19T14:17:08+00:00","modified_at":"2026-10-19T21:14:14+00:00","first_seen_at":"2026-10-23T21:57:18+00:00","fetched_at":"2026-10-23T22:28:57+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}