Vulnerability · Published Oct 19, 2026 · Assigned by VulnCheck

CVE-2026-112294FlyCms through commit edfdf724 Missing Authorization via Action Counter Endpoint

Medium 4.3

In plain English

A medium-severity authorization bypass via user-controlled key in FlyCms from sunkaifei. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 9% of all known vulnerabilities).

Severity (CVSS 3.1)4.3Medium

Exploit odds (30 days)0.2%top 90.6% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

FlyCms through commit edfdf724 contains a missing authorization vulnerability in ActionService.counter() that allows authenticated users to modify other users' content rows because checkRowOwner never verifies ownership. Any registered user can send requests to /ucenter/action/{modelCode}/{id}/counter or /ucenter/action/compose to add arbitrary deltas to numeric fields like price, stock, or points.

Affected products (as reported)

Vendor	Product	Versions
sunkaifei	FlyCms	0 – through edfdf724c3b944310f60c29aa755d03a00a75837

Weakness: CWE-639 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

References

https://github.com/sunkaifei/FlyCms/issues/19 issue-tracking
https://github.com/sunkaifei/FlyCms/blob/edfdf724c3b944310f60c29aa755d03a00a75837/backend/src/main/java/com/flycms/module/model/service/ActionService.java technical-description
https://github.com/sunkaifei/FlyCms/blob/edfdf724c3b944310f60c29aa755d03a00a75837/backend/src/main/java/com/flycms/web/front/ActionController.java technical-description
VulnCheck Advisory: FlyCms through commit edfdf724 Missing Authorization via Action Counter Endpoint third-party-advisory