CVE-2026-112295

FlyCms versions through commit edfdf724 are vulnerable to a mass assignment vulnerability via the /ucenter/account_update endpoint. This flaw allows authenticated users to overwrite protected account columns by submitting extra User bean fields . Exploitation can result in unauthorized modificati...

CVE-2026-112295 FlyCms through commit edfdf724 Mass Assignment via /ucenter/account_update

FlyCms through commit edfdf724 contains a mass assignment vulnerability that allows authenticated users to overwrite protected account columns by submitting extra User bean fields to /ucenter/accountupdate. Attackers can change their review status, rename themselves, or duplicate another account'...