CVE-2026-112296 Details
Description
FlyCms through commit edfdf724 contains a default credentials vulnerability that allows unauthenticated remote attackers to gain super administrator access via the flycms account with password admin123. Attackers can log in through POST /api/auth/login, solving only the image captcha, to obtain full control of site content, users and configuration.
A default credentials vulnerability has been identified in FlyCms, specifically in the commit prior to edfdf724. This vulnerability allows unauthenticated remote attackers to gain super administrator access through the flycms account, using the password admin123. Exploitation involves logging in via the POST /api/auth/login endpoint, after solving a simple image captcha. Once logged in, attackers can gain full control over the site's content, user management, and configuration settings.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 19, 2026CISA-ADP
Assessed Oct 19, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/sunkaifei/FlyCms/blob/edfdf724c3b944310f60c29aa755d03a00a75837/README.md | [email protected] | Source CodeVendor |
| https://github.com/sunkaifei/FlyCms/blob/edfdf724c3b944310f60c29aa755d03a00a75837/sql/flycms_20260928_093335.sql | [email protected] | Source CodeVendor |
| https://github.com/sunkaifei/FlyCms/issues/19 | [email protected] | ExploitIssue TrackingTechnical AnalysisVendor |
| https://www.vulncheck.com/advisories/flycms-through-commit-edfdf724-default-super-administrator-credentials | [email protected] | AdvisoryBundle |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-1392 | Use of Default Credentials | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| FlyCms | <= edfdf724c3b944310f60c29aa755d03a00a75837 |
CPE
Remediation
| |
Change History
3 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Oct 27, 2026 | CVE Modified | [email protected] |
| Oct 19, 2026 | CVE Modified | CISA-ADP |
| Oct 19, 2026 | New CVE Received | [email protected] |