CVE-2026-112295 — FlyCms through commit edfdf724 Mass Assignment via /ucenter/account_update
FlyCms through commit edfdf724 contains a mass assignment vulnerability that allows authenticated users to overwrite protected account columns by submitting extra User bean fiel…
Published: 2026-10-19 · CVSS: 5.3 · CVSS 4.0
FlyCms through commit edfdf724 contains a mass assignment vulnerability that allows authenticated users to overwrite protected account columns by submitting extra User bean fields to /ucenter/account_update. Attackers can change their review status, rename themselves, or duplicate another account's username, email or mobile to break that victim's login.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7