The flaw is a mass‑assignment vulnerability that lets users who are already authenticated submit additional fields to the account_update endpoint. This allows the attacker to override protected columns such as review status, username, email, and mobile. By duplicating another account’s username or changing identifying data, an authenticated user can effectively impersonate or sabotage a victim’s account. The weakness is a form of improper input validation (CWE‑915).

FlyCMS, a content management system developed by the sunkaifei organization, is affected whenever the code path in UserService.java and UserController.java for the /ucenter/account_update route is reachable. The vulnerability is present in the commit edfdf724 and any earlier releases that contain that code without the subsequent fix. No specific software version numbers are listed, so any deployment of FlyCMS that has not been updated to a later commit is potentially vulnerable.

The CVSS score of 5.3 indicates a medium severity flaw. Because the attacker must first have a legitimate user account, the attack vector is authenticated. The EPSS score is not available, so exact exploitation likelihood is unknown, but the lack of a KEV listing suggests a low to moderate risk of wide‑scale exploitation. However, once accessed, the attacker can readily modify sensitive account fields, potentially leading to account takeover or service disruption.