CVE-2026-112294: FlyCms through commit edfdf724 Missing Authorization via Action Counter Endpoint
FlyCms through commit edfdf724 contains a missing authorization vulnerability in ActionService.counter() that allows authenticated users to modify other users' content rows because checkRowOwner never verifies ownership. Any registered user can send requests to /ucenter/action/{modelCode}/{id}/counter or /ucenter/action/compose to add arbitrary deltas to numeric fields like price, stock, or points.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
Any registered, authenticated FlyCms user can exploit it. The attacker does not need to own the target content row because ownership is not verified.
What can an attacker change?
An attacker can submit arbitrary deltas to numeric fields on other users' content rows, including fields such as price, stock, and points. The affected request paths are /ucenter/action/{modelCode}/{id}/counter and /ucenter/action/compose.
Is this exposed to unauthenticated internet users?
No. Exploitation requires a low-privileged authenticated account, although the vulnerable endpoints are network-accessible.