{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/vendors/flycms/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:flycms:flycms:*:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":9.8,"id":"CVE-2026-112296"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["FlyCms (\u003c= edfdf724)"],"_cs_severities":["critical"],"_cs_tags":["web-vulnerability","credential-abuse"],"_cs_type":"advisory","_cs_vendors":["FlyCms"],"content_html":"\u003cp\u003eFlyCms versions through commit edfdf724 contain a critical default credentials vulnerability. An unauthenticated remote attacker can exploit this flaw by leveraging the default username 'flycms' and password 'admin123'. By sending a POST request to the application's authentication endpoint and successfully solving the required image captcha, an attacker can authenticate as a super administrator. This grants the attacker full control over the application's content, user management, and system configuration. Given the ease of exploitation and the level of access granted, organizations running affected versions of FlyCms are at high risk of unauthorized site takeover.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation results in full administrative control over the FlyCms instance. This allows attackers to modify site content, manipulate user accounts, and alter system configurations, potentially leading to persistent unauthorized access, data exfiltration, or further compromise of the underlying hosting environment.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eImmediately audit all FlyCms instances to identify and update any installations running code versions at or prior to commit edfdf724.\u003c/li\u003e\n\u003cli\u003eImplement a policy to change default vendor credentials upon initial deployment for all web-based content management systems.\u003c/li\u003e\n\u003cli\u003eMonitor web server access logs for anomalous POST requests to /api/auth/login that originate from unexpected or external IP addresses.\u003c/li\u003e\n\u003cli\u003eRestrict access to administrative login endpoints to trusted IP ranges or VPN-only access to prevent public exploitation attempts.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-10-19T16:08:55Z","date_published":"2026-10-19T16:08:55Z","id":"https://feed.craftedsignal.io/briefs/2026-10-flycms-default-creds/","summary":"A default credentials vulnerability in FlyCms through commit edfdf724 allows unauthenticated attackers to gain administrative access using the flycms account and admin123 password.","title":"Default Credentials Vulnerability in FlyCms (CVE-2026-112296)","url":"https://feed.craftedsignal.io/briefs/2026-10-flycms-default-creds/"}],"language":"en","title":"CraftedSignal Threat Feed - FlyCms","version":"https://jsonfeed.org/version/1.1"}