External risk intelligence

FlyCms Default Credentials Allow Unauthenticated Super Administrator Access

CVE advisorySeverity: CRITICAL (CVSS 9.3)

CVE-2026-112296

FlyCms is a content management system designed to serve web content. By nature, such applications are typically deployed as internet-facing web applications or API endpoints to manage site content and user data, making public exposure common for the authentication interface where this vulnerability resides.

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

This advisory addresses a critical vulnerability in FlyCms, a content management system, stemming from default administrator credentials. An unauthenticated remote attacker could exploit this by logging in with the default username and password to gain complete control over site content, users, and configurations. The primary concern is to determine if this specific system is in use and potentially exposed.

Easy-to-guess default credentials allow unauthorized access.
Critical flaw grants full control over website content.
Confirm use and exposure of this system.

Attack Path

How an attacker could exploit the issue

An attacker can exploit this vulnerability by sending a POST request to the `/api/auth/login` endpoint. This allows them to bypass authentication using default credentials and a solved image captcha to gain complete control over the website's content, users, and settings.

Unauthenticated remote access required.
POST to `/api/auth/login` with default credentials.
Full control over site content and users.

Live Threat

Current exploitation, exposure, and threat context

This vulnerability could allow unauthenticated remote attackers to gain super administrator access to FlyCms by exploiting default credentials. This access could enable full control over site content, user data, and system configuration.

Site content and user data at risk.
Attackers could log in via a specific API endpoint.
Full control of site content and users.

Operational Fix

Recommended remediation, mitigation, and detection steps

This vulnerability in FlyCms, allowing unauthenticated access via default super administrator credentials, likely impacts teams responsible for web application content management systems. The first practical step is to identify all FlyCms instances, determine their exposure and business criticality, and then locate the accountable system owner to plan remediation.

Application owners must address the vulnerability.
Verify all FlyCms instances and their reachability.
Plan remediation based on identified risks.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is FlyCms?

FlyCms is a content management system (CMS) utilized by developers and organizations to organize, store, and publish digital information on the web. It functions as a backend platform that enables users to manage site content, configuration settings, and user accounts through an administrative interface.

What is the vulnerability in CVE-2026-112296?

This vulnerability is classified as Use of Default Credentials (CWE-1392). In plain terms, the software ships with a pre-configured, well-known username and password combination for the super administrator account. Because these credentials are not unique to the installation, they function as a backdoor for anyone who knows them.

How does an attacker exploit this flaw?

An attacker targets the authentication process by sending a specific request to the application's login endpoint. While the system requires solving an image captcha to process the request, it does not verify the identity of the user beyond the default password. Simply navigating to the site without knowledge of these credentials will not trigger the vulnerability; it requires intentional submission of the known admin login.

Is my instance of FlyCms at risk?

Halo Surface Signal indicates that FlyCms is typically deployed as an internet-facing web application or API, meaning it is often directly accessible from the public internet. If your instance is reachable via a public URL, it is at higher risk because the authentication interface is exposed to remote, unauthenticated actors globally.

What should I do first to secure my FlyCms installation?

The immediate priority is to locate all instances of FlyCms within your environment and identify the owners responsible for them. Once you have a complete inventory, verify whether the default administrative credentials are still in place and restrict access to the login endpoint to prevent unauthorized remote requests.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.