The vulnerability is a missing authorization check in ActionService.counter() that allows any authenticated user to invoke the /ucenter/action/{modelCode}/{id}/counter and /ucenter/action/compose endpoints. This flaw permits the attacker to increase numeric fields such as price, stock, or points on records that belong to other users, resulting in widespread data integrity compromise and enabling fraudulent manipulation of e-commerce or CMS values.

The flaw exists in the FlyCms application maintained by sunkaifei and is present in all releases that contain code from commit edfdf724 or earlier. Users of that CMS who have legitimate accounts can exploit the endpoints without further privileges.

The CVSS score of 5.3 classifies the issue as medium severity, yet the exploit requires only normal authentication and does not involve bypassing application security. Because EPSS data is not available, the exact likelihood cannot be assessed, and the vulnerability is not currently listed in the CISA KEV catalog. However, since any registered user can abuse the endpoints, the risk of data corruption or financial fraud remains significant and relatively easy to execute.