EUVD-2026-104279
GHSA-v455-8jmh-chm4
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessRegister FlyCms user account
-
DeliveryAuthenticate to /ucenter
-
ExploitSend crafted counter/compose request for victim row
-
ExecutionBypass missing checkRowOwner check
-
ImpactTamper numeric fields (price/stock/points)
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Object-level authorization, IDOR prevention
|
| Exploitation Conditions | Requires a valid registered FlyCms user account (PR:L); the instance must permit user registration/login, which is the normal deployment mode for this community CMS. The specific trigger is any request to /ucenter/action/{modelCode}/{id}/counter or /ucenter/action/compose referencing a row owned by another user, where ActionService.counter() invokes checkRowOwner without actually verifying ownership. Limiting factors: the attacker must be authenticated (no anonymous exploitation), and impact is confined to incrementing/decrementing numeric model fields - there is no confidentiality disclosure or service disruption, and the practical business impact depends on whether sensitive numeric fields like price, stock, or points are in use. |
| Impact | This is a genuine but moderate-severity issue, not a top-tier emergency. The provided CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N) and the CWE-639 classification agree internally: it is a network-reachable, low-complexity Insecure Direct Object Reference (missing authorization check) requiring only a low-privilege authenticated account, with impact limited to Integrity (VI:L) and no Confidentiality or Availability effect. No EPSS score, no CISA KEV listing, and no public exploit code were provided, which collectively argues against widespread opportunistic exploitation. The 5.3 base score reflects the authentication prerequisite (PR:L) and the bounded integrity-only impact, so this is a real-but-contained data-tampering flaw rather than a high-CVSS-but-low-real-risk false alarm - though the business impact of tampering with 'price', 'stock', or 'points' fields could exceed what CVSS's 'Low' integrity rating suggests for an e-commerce or points-based deployment. CONFLICT TO NOTE: the input Tag 'Authentication Bypass' contradicts the description and CWE-639, which describe an AUTHORIZATION (ownership) bypass by an already-authenticated user - these are distinct, and the authentication-bypass framing overstates the flaw. |
| Exploit ScenarioDerived | A registered FlyCms user logs in, then sends a crafted request to /ucenter/action/{modelCode}/{id}/counter (or /ucenter/action/compose) referencing content rows they do not own, because ActionService.counter()'s checkRowOwner never validates ownership. They add arbitrary deltas to numeric fields such as price, stock, or points - for example zeroing another seller's price or inflating their own points balance. No public proof-of-concept was identified at time of analysis, but exploitation is trivial given a low-privilege account. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 19, 2026
FlyCms (through commit edfdf724) fails to enforce object-level authorization in the /ucenter/action/{modelCode}/{id}/counter and /ucenter/action/compose endpoints, letting any registered user tamper with numeric fields - price, stock, points - on content rows belonging to other accounts. The root cause is ActionService.counter(), which calls a checkRowOwner routine that never actually compares the requesting user to the row's owner. Exploitation requires only a self-registered account (authenticated, PR:L) and does not expose data or disrupt availability, so the practical damage depends on whether business-critical numeric fields are in use. No public exploit code or active exploitation was identified at time of analysis.
RemediationAI
No vendor-released patch identified at time of analysis - the cited references point to the vulnerable source at commit edfdf724 and a GitHub issue thread rather than a fixed release, so verify against https://github.com/sunkaifei/FlyCms/issues/19 and the maintainer's repository before upgrading. The durable fix is code-level: make checkRowOwner in com/flycms/module/model/service/ActionService.java actually resolve the row's owning user and compare it to the authenticated principal, and have ActionController authorize {modelCode} against a server-side allowlist of counter-capable fields so clients cannot target arbitrary numeric columns. Until that is in place, compensating controls are: block or restrict POST access to /ucenter/action/*/counter and /ucenter/action/compose at the reverse proxy for everyone except trusted administrative accounts (trade-off: the legitimate counter/compose UI features break for normal users); disable self-service registration and audit existing accounts for unauthorized creations (trade-off: manual user onboarding); and add monitoring or database triggers that alert on unexpected changes to price, stock, or points columns, with periodic reconciliation against backups (trade-off: detection-only, no prevention, plus operational overhead). Applying all three limits exposure while the upstream fix is pending.
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
FlyCms is a Java/Spring-based community CMS; the affected code lives in backend/src/main/java/com/flycms/module/model/service/ActionService.java, with the HTTP entry points in com.flycms/web/front/ActionController.java. The vulnerability class is CWE-639, Authorization Bypass Through User-Controlled Key (IDOR): the controller passes a client-supplied {modelCode} and {id} into ActionService.counter(), which delegates to checkRowOwner. That helper is a stub that never compares the authenticated principal against the row's owning user, so the ownership check is effectively decorative. The counter operation applies a caller-supplied delta to a numeric column of the referenced model row - price/stock/points are typical targets in this schema - meaning the same primitive allows upward or downward manipulation of business values. Because the endpoints sit under /ucenter/, the only gate is session authentication; there is no role or ownership constraint beyond the broken check.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N
Network-reachable endpoint with low complexity; a registered account is required so PR:L; impact is unauthorized modification of numeric fields only, hence I:L with C:N and A:N.
Primary rating from Vendor (vulncheck).
CVSS VectorVendor: vulncheck
DescriptionCVE.org
FlyCms through commit edfdf724 contains a missing authorization vulnerability in ActionService.counter() that allows authenticated users to modify other users' content rows because checkRowOwner never verifies ownership. Any registered user can send requests to /ucenter/action/{modelCode}/{id}/counter or /ucenter/action/compose to add arbitrary deltas to numeric fields like price, stock, or points.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
Exploit-DB