CVE-2026-112295 in FlyCms
Summary
by MITRE • 10/19/2026
FlyCms through commit edfdf724 contains a mass assignment vulnerability that allows authenticated users to overwrite protected account columns by submitting extra User bean fields to /ucenter/account_update. Attackers can change their review status, rename themselves, or duplicate another account's username, email or mobile to break that victim's login.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 10/19/2026
The identified security flaw resides within FlyCms, specifically affecting the user center module prior to commit edfdf724. This vulnerability is classified as a mass assignment issue, which represents a critical category of insecure direct object references and improper authorization flaws. In web application development, mass assignment occurs when an application automatically binds incoming HTTP request parameters directly to properties of a server-side data model or object without sufficient validation or filtering. In the context of FlyCms, this mechanism is improperly implemented in the account update functionality located at the /ucenter/account_update endpoint. The system fails to enforce strict allow-lists for user-supplied input when updating the User bean, thereby permitting authenticated users to manipulate fields that are intended to be protected from direct modification by end-users.
From a technical perspective, the vulnerability stems from the lack of attribute filtering during the deserialization or binding process of the request payload. When an authenticated user submits data to update their account information, the backend framework processes all provided key-value pairs and attempts to map them to corresponding properties in the User object model. Because protected columns such as review status, username, email address, and mobile number are not excluded from this mapping process, a malicious actor can inject these fields into the request body. By doing so, they bypass standard application logic that would normally restrict changes to only non-sensitive profile details like display names or avatars. This behavior aligns with CWE-915, which describes Improper Control of Dynamically-Managed Code Resources, specifically regarding the misuse of object property binding mechanisms that fail to respect intended access controls.
The operational impact of this vulnerability is severe and multifaceted, affecting both data integrity and account availability for legitimate users. An attacker can exploit this flaw to alter their own review status, potentially bypassing administrative approval workflows required for new accounts or content moderation systems. More critically, the ability to overwrite protected fields such as username, email, and mobile number enables sophisticated account takeover attacks. By setting these fields to values belonging to another victim's account, an attacker can effectively hijack that identity within the system. This action breaks the victim's login capability because their credentials no longer match the unique identifiers stored in the database for authentication purposes. Consequently, this constitutes a denial of service against the legitimate user while granting the attacker full control over the compromised account profile.
This exploitation technique maps directly to several entries in the MITRE ATT&CK framework, reflecting common adversary behaviors in real-world attacks. The initial access and privilege escalation aspects relate to T1078 Valid Accounts, as the attack requires valid authentication credentials but leverages them for unauthorized modifications. The specific act of modifying account attributes falls under T1098 Account Manipulation, where adversaries alter existing accounts to maintain persistence or escalate privileges. Furthermore, the disruption caused by locking out victims aligns with T1499 Endpoint Denial of Service, although in this context it is achieved through logical manipulation rather than resource exhaustion. Understanding these mappings helps security teams prioritize detection rules and monitoring strategies focused on unusual changes to user profile attributes via API endpoints.
To mitigate this vulnerability, developers must implement strict input validation using an allow-list approach for all mass assignment operations. This involves explicitly defining which properties of the User bean are safe to update from client-side requests and ensuring that any other fields are ignored or stripped before being persisted to the database. Implementing a dedicated DTO (Data Transfer Object) pattern can further isolate user-supplied data from internal domain models, preventing accidental binding of sensitive attributes. Additionally, applying principle of least privilege ensures that even if an attacker gains access to these endpoints, they cannot modify administrative flags or critical identity fields without explicit server-side authorization checks. Regular code reviews focusing on ORM configurations and framework-specific mass assignment behaviors are essential to prevent similar flaws in other modules of the application.