{"id":"CVE-2026-112294","title":"FlyCms through commit edfdf724 Missing Authorization via Action Counter Endpoint","summary":"FlyCms through commit edfdf724 contains a missing authorization vulnerability in ActionService.counter() that allows authenticated users to modify other users' content rows because checkRowOwner never verifies ownership. Any registered u…","severity":"medium","cvss":4.3,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N","cvssSource":"cna","cwe":["CWE-639"],"vendor":"sunkaifei","product":"FlyCms","affected":["FlyCms <= edfdf724c3b944310f60c29aa755d03a00a75837"],"published":"2026-10-19","updated":"2026-10-19","sourceUpdated":"2026-10-19T13:55:35.493Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-112294","references":[{"url":"https://github.com/sunkaifei/FlyCms/issues/19"},{"url":"https://github.com/sunkaifei/FlyCms/blob/edfdf724c3b944310f60c29aa755d03a00a75837/backend/src/main/java/com/flycms/module/model/service/ActionService.java"},{"url":"https://github.com/sunkaifei/FlyCms/blob/edfdf724c3b944310f60c29aa755d03a00a75837/backend/src/main/java/com/flycms/web/front/ActionController.java"},{"url":"https://www.vulncheck.com/advisories/flycms-through-commit-edfdf724-missing-authorization-via-action-counter-endpoint","label":"VulnCheck Advisory: FlyCms through commit edfdf724 Missing Authorization via Action Counter Endpoint"}],"tags":["cve.org"],"ingestedAt":"2026-10-19T14:30:01.067Z","slug":"CVE-2026-112294","body":"## Overview\n\nFlyCms through commit edfdf724 contains a missing authorization vulnerability in ActionService.counter() that allows authenticated users to modify other users' content rows because checkRowOwner never verifies ownership. Any registered user can send requests to /ucenter/action/{modelCode}/{id}/counter or /ucenter/action/compose to add arbitrary deltas to numeric fields like price, stock, or points.\n\n## Affected\n\n- `FlyCms <= edfdf724c3b944310f60c29aa755d03a00a75837`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"sunlit","depthScore":24,"depthScoreParts":{"impact":23.7,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}