Description
FlyCms through commit edfdf724 contains a mass assignment vulnerability that allows authenticated users to overwrite protected account columns by submitting extra User bean fields to /ucenter/account_update. Attackers can change their review status, rename themselves, or duplicate another account's username, email or mobile to break that victim's login.
Published: 2026-10-19
Score: 5.3 Medium
EPSS: n/a
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Analysis and contextual insights are available on OpenCVE Cloud.

Remediation

No vendor fix or workaround currently provided.

Additional remediation guidance may be available on OpenCVE Cloud.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Mon, 19 Oct 2026 14:15:00 +0000

Type Values Removed Values Added
Description FlyCms through commit edfdf724 contains a mass assignment vulnerability that allows authenticated users to overwrite protected account columns by submitting extra User bean fields to /ucenter/account_update. Attackers can change their review status, rename themselves, or duplicate another account's username, email or mobile to break that victim's login.
Title FlyCms through commit edfdf724 Mass Assignment via /ucenter/account_update
Weaknesses CWE-915
References
Metrics cvssV3_1

{'score': 5.4, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L'}

cvssV4_0

{'score': 5.3, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N'}

Subscriptions

No data.

cve-icon MITRE

Status: PUBLISHED

Assigner: VulnCheck

Published:

Updated: 2026-10-19T16:34:17.549Z

Reserved: 2026-10-19T13:25:35.388Z

Link: CVE-2026-112295

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-10-19T14:17:08.363

Modified: 2026-10-19T14:17:08.363

Link: CVE-2026-112295

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-19T15:45:17Z

Weaknesses
  • CWE-915

    Improperly Controlled Modification of Dynamically-Determined Object Attributes