CVE-2026-112296: FlyCms through commit edfdf724 Default Super Administrator Credentials
FlyCms through commit edfdf724 contains a default credentials vulnerability that allows unauthenticated remote attackers to gain super administrator access via the flycms account with password admin123. Attackers can log in through POST /api/auth/login, solving only the image captcha, to obtain full control of site content, users and configuration.
Affected Software
Event History
Frequently Asked Questions
Who is exposed to this issue?
Any FlyCms deployment through commit edfdf724 that retains the documented flycms account with the password admin123 is exposed. The login is reachable remotely through the authentication API.
What does an attacker need to exploit it?
An attacker needs no existing account or privileges. They need only submit the default flycms/admin123 credentials to POST /api/auth/login and solve the image CAPTCHA.
Is a default installation affected?
Yes. The issue is caused by default super-administrator credentials, so deployments where those credentials have not been changed are affected.
What access does successful exploitation provide?
Successful login grants super administrator access, allowing control over site content, users, and configuration.
What can be done if patching is not immediately possible?
Change or disable the default flycms administrator account and password immediately, and restrict access to the login endpoint where operationally feasible.