CVE-2026-112295: FlyCms through commit edfdf724 Mass Assignment via /ucenter/account_update
FlyCms through commit edfdf724 contains a mass assignment vulnerability that allows authenticated users to overwrite protected account columns by submitting extra User bean fields to /ucenter/accountupdate. Attackers can change their review status, rename themselves, or duplicate another account's username, email or mobile to break that victim's login.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
An attacker must be authenticated as a FlyCms user. No user interaction is required, and the affected endpoint is network-accessible.
What can an attacker change through the vulnerable endpoint?
By submitting additional User bean fields to /ucenter/account_update, an authenticated user can overwrite protected account columns. Reported impacts include changing review status, renaming their account, and duplicating another account's username, email address, or mobile number.
How could this affect other users?
An attacker can duplicate a victim's username, email address, or mobile number, which can prevent that victim from logging in. The vulnerability can also alter account review status.