CVE-2026-112296

FlyCms through commit edfdf724 contains a default credentials vulnerability that allows unauthenticated remote attackers to gain super administrator access via the flycms account with password admin123. Attackers can log in through POST /api/auth/login, solving only the image captcha, to obtain full control of site content, users and configuration.

Any attacker can gain full administrative control over the site without knowing secret credentials. This leads to content modification, data theft, and further compromise.

Immediately change the default flycms account credentials and enforce strong passwords for all administrative accounts. Update FlyCms to a version where the issue is fixed or apply patches.