CVE-2026-112295: Improperly Controlled Modification of Dynamically-Determined Object Attributes in sunkaifei FlyCms

CVE-2026-112295 describes a mass assignment vulnerability in FlyCms (version 0) where authenticated users can submit additional User bean fields to the /ucenter/account_update endpoint. This improper control over dynamically-determined object attributes allows attackers to overwrite protected account columns, including review status and unique identifiers like username, email, and mobile number. The vulnerability arises from insufficient validation or filtering of input fields during account updates, enabling attackers to impersonate or disrupt other user accounts.

Exploitation of this vulnerability allows authenticated attackers to alter protected account attributes, such as changing their review status, renaming themselves, or duplicating another user's username, email, or mobile number. This can break the victim's login and potentially cause account confusion or unauthorized access scenarios. The CVSS 4.0 base score is 5.3 (medium severity), reflecting the moderate impact and the requirement for authentication.

No patch or official fix information is provided. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict access to the /ucenter/account_update endpoint to trusted users only and monitor for suspicious account modifications. Implement input validation and server-side filtering to prevent unauthorized attribute modification.