---
id: "CVE-2026-112295"
kind: "vulnerability"
aliases: ["CVE-2026-112295"]
title: "FlyCms: account update lets users overwrite protected account fields"
severity: "medium"
cvss: 5.4
epss: null
exploited: false
status: "open"
category: "other"
products: []
ecosystems: []
tags: ["flycms", "other", "php", "self-hosted"]
not_affected_if: ["auth-required", "no-public-registration"]
published_at: "2026-10-19T14:17:08+00:00"
first_seen_at: "2026-10-23T21:57:18+00:00"
updated_at: "2026-10-25T04:16:46+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-112295", "first_seen_at": "2026-10-23T21:57:18+00:00"}]
---

# FlyCms: account update lets users overwrite protected account fields

FlyCms through commit edfdf724 accepts extra User fields on the /ucenter/account_update endpoint, so a logged-in user can overwrite protected account columns. An attacker can change their own review status or username, or copy another account's username, email or mobile to lock that victim out of their login.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check whether the deployed FlyCms code includes commit `edfdf724` or earlier, for example with `git log --oneline | grep edfdf724` in the FlyCms checkout
- Review the account update handler behind `/ucenter/account_update` to see whether it binds the whole User bean without an allow-list of fields

## Timeline

- 2026-10-23T21:57:18+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-112295

## From the sources

FlyCms through commit edfdf724 contains a mass assignment vulnerability that allows authenticated users to overwrite protected account columns by submitting extra User bean fields to /ucenter/account_update. Attackers can change their review status, rename themselves, or duplicate another account's username, email or mobile to break that victim's login.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_