# CVE-2026-112295: FlyCms mass assignment vulnerability in account update

Source: https://junglewise.ai/threats/cve-2026-112295-flycms-through-commit-edfdf724-contains-a-mass-assignment  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-19. Updated: 2026-10-19  
License: CC BY 4.0 with a link back

CVE-2026-112295 · Severity: medium · CVSS 5.4 · Published 2026-10-19

FlyCms is an open-source Q&A and knowledge base platform built with Java and Spring Boot. An authenticated attacker can exploit a mass assignment flaw in the account update endpoint to modify protected user fields like review status, username, email, or mobile number, potentially hijacking other users' accounts or disrupting their access.

Technologies: [Sunkaifei Flycms](https://junglewise.ai/threats/technologies/flycms). Vendors: [Sunkaifei](https://junglewise.ai/threats/vendors/sunkaifei).

## Quick answers

**Is CVE-2026-112295 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-112295 being exploited in the wild.

**How severe is CVE-2026-112295?** Medium severity, with a CVSS score of 5.4, published 19 October 2026.

**Which products and versions are affected?** Sunkaifei Flycms through commit edfdf724.

**Is there a fix for CVE-2026-112295?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-112295 attacked?** It is attacked over the network.

**Am I affected by CVE-2026-112295?** Check whether you run Sunkaifei Flycms at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A mass assignment vulnerability in the /ucenter/account_update endpoint allows authenticated users to submit extra User bean fields that overwrite protected account columns in the database. The vulnerability affects the UserService component and requires authentication; an attacker can change their own review status, rename their account, or duplicate another user's email/mobile/username to break that victim's login capability.

## Affected products

- sunkaifei FlyCms through commit edfdf724

## Timeline

- 2026-10-19: disclosed

## References

- [https://github.com/sunkaifei/FlyCms](https://github.com/sunkaifei/FlyCms)
- [https://github.com/sunkaifei/FlyCms/blob/edfdf724c3b944310f60c29aa755d03a00a75837/backend/src/main/java/com/flycms/module/user/service/UserService.java](https://github.com/sunkaifei/FlyCms/blob/edfdf724c3b944310f60c29aa755d03a00a75837/backend/src/main/java/com/flycms/module/user/service/UserService.java)

## Related threats

- [FlyCms default credentials remote admin access](https://junglewise.ai/threats/cve-2026-112296-flycms-through-commit-edfdf724-contains-a-default-credentials)
- [A weakness has been identified in sunkaifei FlyCMS up to abbaa5a8daefb146ad4d61027035026b052cb414. The impacted…](https://junglewise.ai/threats/cve-2025-15094-a-weakness-has-been-identified-in-sunkaifei-flycms-up-to)
- [A security flaw has been discovered in sunkaifei FlyCMS up to abbaa5a8daefb146ad4d61027035026b052cb414. The affected…](https://junglewise.ai/threats/cve-2025-15093-a-security-flaw-has-been-discovered-in-sunkaifei-flycms-up-to)