Is CVE-2026-112294 being exploited?

No public exploit is currently tracked.

How severe is CVE-2026-112294?

CVE-2026-112294 has a CVSS v3 severity of MEDIUM (4.3).

Back

CVE-2026-112294

Description

FlyCms through commit edfdf724 contains a missing authorization vulnerability in ActionService.counter() that allows authenticated users to modify other users' content rows because checkRowOwner never verifies ownership. Any registered user can send requests to /ucenter/action/{modelCode}/{id}/counter or /ucenter/action/compose to add arbitrary deltas to numeric fields like price, stock, or points.