FlyCms EUVD-2026-104278

Requires an authenticated FlyCms session (any low-privileged registered user, PR:L) and the ability to POST to the /ucenter/account_update endpoint with additional User bean fields beyond the intended profile fields; the server must bind those extra fields without a whitelist, which is the core defect in this commit. Limiting factors: exploitation is not anonymous - an attacker needs valid account credentials/registration on the target instance - and impact is confined to altering account columns (self review-status change, rename, or credential collision to deny a victim's login) with no direct confidentiality breach or remote code execution. Default affected configuration is any FlyCms deployment at or before commit edfdf724 that exposes user self-service account updates.

This is a medium-severity (CVSS 4.0 base 5.3) mass-assignment flaw (CWE-915) whose real-world risk is modest and bounded. The provided CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L) indicates network-reachable, low-complexity exploitation but requires existing low-level authentication (PR:L) - i.e., any registered FlyCms user, not an anonymous attacker. Impact is integrity-limited (VI:L) and availability-limited (VA:L) with no confidentiality loss (VC:N), consistent with the description: an attacker alters their own protected account columns or collides a victim's username/email/mobile to deny that victim's login. No EPSS score, KEV listing, POC, or SSVC decision data was supplied, so exploitation-likelihood signals are absent rather than low - I cannot assert widespread exploitation. Note the input 'Information Disclosure' tag conflicts with the CVSS vector, which explicitly sets VC:N (no confidentiality impact); the actual security effect is integrity/account-takeover-adjacent and availability (login denial), not disclosure. Overall this is a legitimate but lower-tier issue: real because exploitation is simple for any authenticated user against an unpatched instance, but not an emergency given the obscure product footprint and absence of confidentiality impact or active-exploitation evidence.

A low-privileged registered user of a FlyCms site submits a POST to /ucenter/account_update that includes extra User bean fields (e.g., review status, username, email, or mobile) beyond those the profile form intends. The server binds these attacker-supplied fields directly onto the persisted User object, letting the attacker self-approve their review status or set their username/email/mobile to match a target victim, thereby breaking the victim's ability to log in. No public exploit code was identified in the supplied data, but the attack requires only a standard authenticated session and a modified form submission (AV:N/AC:L/PR:L).