CVE-2026-112294: Authorization Bypass Through User-Controlled Key in sunkaifei FlyCms

CVE-2026-112294 describes an authorization bypass vulnerability in FlyCms (version 0) where the ActionService.counter() method fails to verify ownership of content rows. Authenticated users can exploit this by sending requests to /ucenter/action/{modelCode}/{id}/counter or /ucenter/action/compose to alter numeric fields like price, stock, or points belonging to other users. The root cause is the missing ownership check in the checkRowOwner function, allowing unauthorized modifications.

The vulnerability allows authenticated users to modify numeric content fields of other users without proper authorization. This can lead to unauthorized changes in critical data such as pricing, inventory stock, or user points, potentially impacting data integrity and business operations. However, the vulnerability requires authentication and does not allow privilege escalation or remote unauthenticated exploitation.

No official patch or vendor advisory is provided for this vulnerability. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict access to the affected endpoints to trusted users only and monitor for suspicious modification activities.