Mass assignment in FlyCms lets users overwrite protected account data
Key facts
- Attack vector
- Network
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Attack requirements
- None
- Impact type
- Tampering
- Confidentiality · integrity · availability
- None · Low · Low
- Fix status
- No fix listed
Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-915.
Summary
FlyCms through commit edfdf724 contains a mass assignment flaw (CWE-915) in the /ucenter/account_update endpoint, which accepts extra User fields from the request. An authenticated user with low privileges can overwrite protected account columns, change their review status, or duplicate another account's username, email or mobile to break that victim's login.
Written with Claude Haiku 5.5 from the sources below · 2026-11-06
Description from the CNA
FlyCms through commit edfdf724 contains a mass assignment vulnerability that allows authenticated users to overwrite protected account columns by submitting extra User bean fields to /ucenter/account_update. Attackers can change their review status, rename themselves, or duplicate another account's username, email or mobile to break that victim's login.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
No affected products listed by the sources yet.
Remediation
The sources list no fixed version for FlyCms.
Written with Claude Haiku 5.5 from the sources below · 2026-11-06
Timeline
- 2026-10-19 Threatist record created from CVE-2026-112295
- 2026-10-19 Alias added: GHSA-pp6m-j5rg-683m
References
Other 4
- https://github.com/sunkaifei/FlyCms/issues/19
- https://github.com/sunkaifei/FlyCms/blob/edfdf724c3b944310f60c29aa755d03a00a75837/backend/src/main/java/com/flycms/web/front/UserController.java
- https://github.com/sunkaifei/FlyCms/blob/edfdf724c3b944310f60c29aa755d03a00a75837/backend/src/main/java/com/flycms/module/user/service/UserService.java
- https://github.com/sunkaifei/FlyCms/blob/edfdf724c3b944310f60c29aa755d03a00a75837/backend/src/main/resources/mapper/user__UserDao.xml
More sunkaifei vulnerabilities
- TI-2024-15191 Cross Site Request Forgery vulnerability in FlyCms v.1.0 allows a remote attacker to… CVSS 3.1HIGH 8.8
- TI-2025-13772 sunkaifei FlyCMS User Login UserController.java userLogin cross site scripting CVSS 4.0MEDIUM 5.3
- TI-2025-13771 sunkaifei FlyCMS Admin Login IndexAdminController.java cross site scripting CVSS 4.0MEDIUM 5.3
- TI-2026-76496 Default super administrator credentials in FlyCms CVSS 4.0CRITICAL 9.3
- TI-2026-76494 FlyCms counter endpoint missing authorization lets users edit others' content CVSS 4.0MEDIUM 5.3
Sources
- CVE-2026-112295 · CVE Program
- CVE-2026-112295 · NVD
- FIRST EPSS
- GHSA-pp6m-j5rg-683m · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences