{"schemaVersion":3,"id":"CVE-2026-112295","aliases":[],"status":"published","duplicateOf":null,"title":null,"description":"FlyCms through commit edfdf724 contains a mass assignment vulnerability that allows authenticated users to overwrite protected account columns by submitting extra User bean fields to /ucenter/account_update. Attackers can change their review status, rename themselves, or duplicate another account's username, email or mobile to break that victim's login.","dates":{"published":"2026-10-19T13:55:36.176Z","modified":"2026-10-19T16:34:17.549Z","reserved":null,"kevAdded":[],"kevDue":[]},"cvss":{"headline":{"score":5.4,"severity":"medium","version":"3.1","versionLabel":"v3.1","source":"CVE.org","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L","computed":false,"selection":"backend-summary"},"metrics":[{"version":"4.0","versionLabel":"v4.0","source":"CVE.org","score":5.3,"severity":"medium","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N","exploitability":null,"impact":null,"computed":false},{"version":"3.1","versionLabel":"v3.1","source":"CVE.org","score":5.4,"severity":"medium","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L","exploitability":null,"impact":null,"computed":false},{"version":"4.0","versionLabel":"v4.0","source":"NVD","score":5.3,"severity":"medium","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","exploitability":null,"impact":null,"computed":false},{"version":"3.1","versionLabel":"v3.1","source":"NVD","score":5.4,"severity":"medium","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L","exploitability":null,"impact":null,"computed":false}]},"epss":{"probability":0.00257,"percentile":0.16355,"severity":"low","asOf":"2026-10-20T00:00:00.000Z","change":{"pp":null,"baselineDate":null,"baselineScore":null},"history":[{"date":"2026-10-20T00:00:00.000Z","score":0.00257,"percentile":0.16355}],"last30":[{"date":"2026-10-20T00:00:00.000Z","score":0.00257,"percentile":0.16355}]},"kev":{"state":"not-listed","entries":[],"listedCount":0,"totalCatalogs":3,"catalogs":[{"source":"cisa","label":"CISA","listed":false,"entry":null},{"source":"enisa","label":"ENISA","listed":false,"entry":null},{"source":"circl","label":"CIRCL","listed":false,"entry":null}]},"ransomware":{"state":"none-recorded","sources":[]},"exploits":[],"exploitCount":0,"weaknesses":[{"id":"CWE-915","name":"Improperly Controlled Modification of Dynamically-Determined Object Attributes","description":"The product receives input from an upstream component that specifies multiple attributes, properties, or fields that are to be initialized or updated in an object, but it does not properly control which attributes can be modified.","type":"weakness","status":"Incomplete","abstraction":"Base","likelihoodOfExploit":null,"url":"https://cwe.mitre.org/data/definitions/915.html"}],"affected":[{"vendor":"sunkaifei","product":"flycms","name":"FlyCms","label":"flycms","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"≤ edfdf724c3b944310f60c29aa755d03a00a75837","noFixRecorded":false,"fixedIn":null}],"versionsText":"≤ edfdf724c3b944310f60c29aa755d03a00a75837","eol":null,"hubHref":"/vendor/sunkaifei/flycms"}],"affectedCount":1,"eol":{"hasEol":false,"count":0},"references":[{"url":"https://github.com/sunkaifei/FlyCms/issues/19","label":"github.com/sunkaifei/FlyCms/issues/19","hostname":"github.com","tags":["Issue Tracking"]},{"url":"https://github.com/sunkaifei/FlyCms/blob/edfdf724c3b944310f60c29aa755d03a00a75837/backend/src/main/java/com/flycms/web/front/UserController.java","label":"github.com/sunkaifei/…","hostname":"github.com","tags":["Technical Description"]},{"url":"https://github.com/sunkaifei/FlyCms/blob/edfdf724c3b944310f60c29aa755d03a00a75837/backend/src/main/java/com/flycms/module/user/service/UserService.java","label":"github.com/sunkaifei/…","hostname":"github.com","tags":["Technical Description"]},{"url":"https://github.com/sunkaifei/FlyCms/blob/edfdf724c3b944310f60c29aa755d03a00a75837/backend/src/main/resources/mapper/user__UserDao.xml","label":"github.com/sunkaifei/…","hostname":"github.com","tags":["Technical Description"]},{"url":"https://www.vulncheck.com/advisories/flycms-through-commit-edfdf724-mass-assignment-via-ucenter-account-update","label":"www.vulncheck.com/advisories/…","hostname":"www.vulncheck.com","tags":["Third Party Advisory"]}],"lineage":{"upstream":[],"downstream":[],"duplicates":[],"related":[]},"timeline":[{"kind":"published","date":"2026-10-19T13:55:36.176Z","label":"Published","detail":"Vulnerability first disclosed.","source":null},{"kind":"modified","date":"2026-10-19T16:34:17.549Z","label":"Last modified","detail":"Vulnerability information updated.","source":null}],"risk":{"score":22,"level":"low","profile":"Default","thresholds":{"critical":75,"high":50,"medium":25,"low":10}},"meta":{"dataAsOf":"2026-10-21T02:17:26.557Z","stale":false,"partial":false}}