FlyCms CVE-2026-112296

The FlyCms instance must ship with and still have the default super-administrator account (username flycms, password admin123) enabled and unchanged, and its /api/auth/login endpoint must be network-reachable. No authentication or prior privileges are required (PR:N). The only limiting factor is the image captcha presented at login, which must be solved per attempt - a minor barrier to pure automation but not to a human or OCR-assisted attacker. Exploitation is prevented only where an administrator has changed or removed the default credentials or where the admin login is not exposed to the attacker's network.

This is a genuine high-priority issue, not a CVSS-inflated paper risk. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N with VC:H/VI:H/VA:H) is fully consistent with the description: a network-reachable, unauthenticated default-credentials flaw (CWE-1392) granting complete super-administrator takeover. All signals point the same direction - the attack is trivial (known static credentials flycms/admin123 over POST /api/auth/login), fully remote, requires no prior access, and yields total compromise of content, users, and configuration. The only friction is an image captcha, which stops naive automated credential-stuffing but not a human or OCR-assisted attacker, so it is a speed-bump rather than a real control. Conflicting/missing signals to note: EPSS score is NOT provided in the input, so exploitation probability cannot be quantified; the product is NOT in CISA KEV and no public exploit code is referenced, so active exploitation is unconfirmed. The tag 'Information Disclosure' understates the impact - this is full administrative takeover (confidentiality, integrity AND availability), not mere disclosure. Net: the technical severity is real and exploitation is near-trivial, but the practical threat is bounded by the product's apparently small deployment footprint rather than by any difficulty of attack.

An attacker discovers an internet-exposed FlyCms instance (at or before commit edfdf724) and sends a POST request to /api/auth/login using the shipped default account flycms with password admin123, solving only the image captcha. Authentication succeeds as super administrator, giving the attacker full control to deface or alter site content, harvest or modify user accounts, and change site configuration. No public exploit code is identified in the provided data, but the attack requires no tooling beyond a browser or HTTP client.