CVE-2026-112296
Received Received - Intake

FlyCms Default Credentials Allow Super Admin Access

Publication date: 2026-10-19

Last updated on: 2026-10-19

Assigner: VulnCheck

Description
FlyCms through commit edfdf724 contains a default credentials vulnerability that allows unauthenticated remote attackers to gain super administrator access via the flycms account with password admin123. Attackers can log in through POST /api/auth/login, solving only the image captcha, to obtain full control of site content, users and configuration.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-19
Last Modified
2026-10-19
Generated
2026-10-19
AI Q&A
2026-10-19
EPSS Evaluated
N/A
NVD
CVE-2026-112296
EUVD
EUVD-2026-104277

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
sunkaifei FlyCms 0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-1392 The product uses default credentials (such as passwords or cryptographic keys) for potentially critical functionality.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

FlyCms has a default credentials vulnerability allowing unauthenticated remote attackers to gain super administrator access. The default account 'flycms' with password 'admin123' can be used to log in via POST /api/auth/login by solving only an image captcha. This grants full control over site content, users, and configuration.

Detection Guidance

Check for unauthorized access via POST /api/auth/login with credentials flycms:admin123. Monitor for unexpected super administrator account creation or unusual login activity.

Impact Analysis

An attacker exploiting this vulnerability could take complete control of your FlyCms website. This includes modifying or deleting content, accessing sensitive user data, changing site configurations, and potentially spreading malware or defacing the site. The impact is severe due to the high CVSS score indicating remote code execution risk.

Compliance Impact

This vulnerability could lead to unauthorized access and exposure of personal data, violating GDPR and HIPAA requirements for data protection and access control. Organizations using FlyCms may face legal penalties, data breach notifications, and reputational damage due to non-compliance with these regulations.

Mitigation Strategies

Immediately change the default password for the flycms account to a strong, unique password. Disable or restrict access to the /api/auth/login endpoint if not required. Update FlyCms to the latest version if a patch is available.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-112296. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart