Missing Authorization Vulnerability in FlyCms by Sunkaifei

CVE-2026-112294

What is CVE-2026-112294?

FlyCms contains a vulnerability in its ActionService.counter() method, where a missing authorization check enables any authenticated user to alter content that belongs to other users. This flaw allows registered users to send requests to sensitive endpoints like /ucenter/action/{modelCode}/{id}/counter or /ucenter/action/compose, thereby modifying numeric fields such as price, stock, or points without verifying ownership. This security oversight poses a significant risk, permitting unauthorized modifications to critical content.

References