CVE-2026-112294 — FlyCms through commit edfdf724 Missing Authorization via Action Counter Endpoint
FlyCms through commit edfdf724 contains a missing authorization vulnerability in ActionService.counter() that allows authenticated users to modify other users' content rows beca…
Published: 2026-10-19 · CVSS: 5.3 · CVSS 4.0
FlyCms through commit edfdf724 contains a missing authorization vulnerability in ActionService.counter() that allows authenticated users to modify other users' content rows because checkRowOwner never verifies ownership. Any registered user can send requests to /ucenter/action/{modelCode}/{id}/counter or /ucenter/action/compose to add arbitrary deltas to numeric fields like price, stock, or points.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7