Orgs face full FlyCms takeover: Patch hardcoded credentials to block CVSS 9.3 super admin exploit

Managed service providers must immediately assess their client environments for FlyCms installations running versions prior to commit edfdf724c3b944310f60c29aa755d03a00a75837. The National Vulnerability Database lists CVE-2026-112296 as a Critical severity flaw with a CVSS score of 9.3. This vulnerability stems from hardcoded default credentials that allow unauthenticated remote attackers to bypass login protections and assume super administrator privileges.

How it unfolded

• The flaw exists in FlyCms code up to commit edfdf724, where default credentials were left in place.
• Attackers can authenticate by sending a POST request to the /api/auth/login endpoint.
• Successful login requires only solving an image captcha, after which the attacker gains full control.

Who is affected

Organizations running FlyCms developed by sunkaifei are exposed to this risk. The vulnerability specifically impacts versions up to commit edfdf724c3b944310f60c29aa755d03a00a75837. According to the NVD record, the weakness is categorized under CWE-1392, which relates to the use of default credentials. Any instance of this software accessible from the internet is potentially vulnerable to unauthorized access and full site takeover.

Our take on the response

The presence of hardcoded credentials in a widely distributed content management system represents a significant configuration failure. While the NVD has assigned a high severity rating, the source material does not indicate that a patched version or official fix has been released yet. That suggests administrators must rely on immediate mitigations rather than waiting for a vendor update to secure their environments against this straightforward authentication bypass.

Who needs to act first

Teams should prioritize auditing public-facing web applications to identify any instances of FlyCms. If the software is detected, administrators must immediately change the default password for the flycms account and any other built-in administrative users. It is advisable to restrict access to the login endpoint using firewall rules or IP whitelisting to limit exposure. Organizations should also review server logs for signs of unauthorized login attempts or unusual administrative activity, ensuring that no attacker has already established persistence within the system.

Background: Firewall rules

Firewall rules Linux systems use are ordered instructions that decide whether network packets enter or leave. They inspect source, destination, and protocol data. You must configure these rules to allow necessary services while blocking unauthorized access attempts.

Read the full guide: Firewall Rules Linux: How Packet Filtering Shapes Network Security

What to do and how to stay safe: FlyCms

• Immediately change the default password for the flycms account and any other administrative accounts on affected systems.
• Restrict network access to the /api/auth/login endpoint to trusted IP addresses only, if possible.
• Monitor server logs for failed login attempts or successful logins from unknown sources to detect active exploitation.
• Verify that no new user accounts or configuration changes have been made by unauthorized actors since the last known good state.

Step-by-step guide: Vulnerability Prioritization: How to Rank Risks Without Wasting Time

General security guidance from the Patch Observer newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

What is the CVSS score for CVE-2026-112296?

The National Vulnerability Database rates the vulnerability as Critical with a CVSS score of 9.3.

How do attackers exploit this vulnerability?

Attackers send a POST request to /api/auth/login with the default credentials flycms and admin123, solving only an image captcha.

Which versions of FlyCms are affected?

The flaw affects FlyCms versions up to commit edfdf724c3b944310f60c29aa755d03a00a75837.