CVE-2026-120448
HighCVSS 8.1Summary
DoraCMS through 3.1.0 contains a mass assignment vulnerability in the PUT /api/v1/user/api-keys/:id endpoint that allows authenticated low-privileged users to rebind their API key to another user's account. Attackers can set the userId field on their own key to a victim's id, then act as that victim to modify profiles and publish or delete content.
Risk Assessment
Enables identity takeover of other users and unauthorized content modifications. May lead to data integrity violations and privilege escalation within the application.
Recommendation
Update DoraCMS to a version newer than 3.1.0 if available, or enforce whitelist validation of updatable fields in the API key endpoint. Additionally, restrict the ability for users to change the userId field.
Other vulnerabilities in DoraCMS
Original NVD description (English source)
DoraCMS through 3.1.0 contains a mass assignment vulnerability in the PUT /api/v1/user/api-keys/:id endpoint that allows authenticated low-privileged users to rebind their API key to another user's account. Attackers can set the userId field on their own key to a victim's id, then act as that victim to modify profiles and publish or delete content.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS