CVE-2026-112294

FlyCms through commit edfdf724 contains a missing authorization vulnerability in ActionService.counter that allows authenticated users to modify other users' content rows because checkRowOwner never verifies ownership. Any registered user can send requests to /ucenter/action/modelCode/id/counter ...

CVE-2026-112294 FlyCms through commit edfdf724 Missing Authorization via Action Counter Endpoint

FlyCms through commit edfdf724 contains a missing authorization vulnerability in ActionService.counter that allows authenticated users to modify other users' content rows because checkRowOwner never verifies ownership. Any registered user can send requests to /ucenter/action/modelCode/id/counter ...

CVE-2026-112294 FlyCms through commit edfdf724 Missing Authorization via Action Counter Endpoint

FlyCms through commit edfdf724 contains a missing authorization vulnerability in ActionService.counter that allows authenticated users to modify other users' content rows because checkRowOwner never verifies ownership. Any registered user can send requests to /ucenter/action/modelCode/id/counter ...

EUVD-2026-104279

FlyCms through commit edfdf724 contains a missing authorization vulnerability in ActionService.counter that allows authenticated users to modify other users' content rows because checkRowOwner never verifies ownership. Any registered user can send requests to /ucenter/action/modelCode/id/counter ...

CVE-2026-112294 FlyCms through commit edfdf724 Missing Authorization via Action Counter Endpoint

FlyCms through commit edfdf724 contains a missing authorization vulnerability in ActionService.counter that allows authenticated users to modify other users' content rows because checkRowOwner never verifies ownership. Any registered user can send requests to /ucenter/action/modelCode/id/counter ...

CVE-2026-112294

The FlyCms application (through commit edfdf724 ) contains a missing authorization vulnerability within the ActionService.counter() method. The root cause is that the checkRowOwner function fails to verify ownership, allowing authenticated users to modify content rows belonging to other users. Sp...

CVE-2026-112294: Authorization Bypass Through User-Controlled Key

FlyCms through commit edfdf724 contains a missing authorization vulnerability in ActionService.counter that allows authenticated users to modify other users' content rows because checkRowOwner never verifies ownership. Any registered user can send requests to /ucenter/action/modelCode/id/counter ...

PT-2026-117438

FlyCms through commit edfdf724 contains a missing authorization vulnerability in ActionService.counter that allows authenticated users to modify other users' content rows because checkRowOwner never verifies ownership. Any registered user can send requests to /ucenter/action/modelCode/id/counter ...

Sunkaifei FlyCms Authorization Issue Vulnerability

The Sunkaifei FlyCms has an authorization issue. This vulnerability stems from the lack of authorization verification in the ActionService.counter function. Additionally, the checkRowOwner method does not validate ownership, allowing authenticated users to modify the content rows of other users...