https://db.gcve.eu/rss/recent/all/10 Most recent entries from all 2026-10-20T11:01:30.311102+00:00 Vulnerability-Lookup info@gcve.eu python-feedgen Contains only the most 10 recent entries. https://db.gcve.eu/vuln/cve-2026-112294 CVE-2026-112294 — FlyCms through commit edfdf724 Missing Authorization via Action Counter Endpoint 2026-10-20T11:01:30.312664+00:00

Affected: sunkaifei FlyCms

FlyCms through commit edfdf724 contains a missing authorization vulnerability in ActionService.counter() that allows authenticated users to modify other users' content rows because checkRowOwner never verifies ownership. Any registered user can send requests to /ucenter/action/{modelCode}/{id}/counter or /ucenter/action/compose to add arbitrary deltas to numeric fields like price, stock, or points.