CVE-2026-120448— DoraCMS through 3.1.0 Mass Assignment via API Key Update Endpoint

Quick assessment

Affected

doramart DoraCMS

Exploitation

No confirmed in-the-wild exploitation; assess based on exposure

Recommended action

Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

DoraCMS 3.1.0 及更早版本在接口中存在批量赋值漏洞。该漏洞允许经过认证的低权限用户将其 API 密钥重新绑定到其他用户的账户上。攻击者可将自身密钥的字段设置为受害者的用户 ID，从而冒充受害者修改个人资料，并执行发布或删除内容等操作。

CVSS 8.1 · High Updated Nov 03, 2026

Possible ATT&CK Techniques 2 AI

T1552 · Unsecured Credentials T1068 · Exploitation for Privilege Escalation

Affected Version Matrix 1

Vendor	Product	Version Range	Status
doramart	DoraCMS	`≤ 3.1.0`	affected

Get alerts for future matching vulnerabilities Log in to subscribe

Vulnerability Information

Have questions about the vulnerability? See if Shenlong's analysis helps!

View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title

DoraCMS through 3.1.0 Mass Assignment via API Key Update Endpoint

Source: CVE Program / CVE List V5

Vulnerability Description

DoraCMS through 3.1.0 contains a mass assignment vulnerability in the PUT /api/v1/user/api-keys/:id endpoint that allows authenticated low-privileged users to rebind their API key to another user's account. Attackers can set the userId field on their own key to a victim's id, then act as that victim to modify profiles and publish or delete content.

Source: CVE Program / CVE List V5

CVSS Information

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

Source: CVE Program / CVE List V5

Vulnerability Type

CWE-915

Source: CVE Program / CVE List V5

Affected Products

Vendor	Product	Affected Versions	CPE	Subscribe
doramart	DoraCMS	0 ~ 3.1.0	-

II. Public POCs for CVE-2026-120448

#	POC Description	Source Link	Shenlong Link

AI-Generated POC Premium

No public POC found.

III. Intelligence Information for CVE-2026-120448

请登录查看更多情报信息。

Other References for CVE-2026-120448 (4)

https://github.com/doramart/DoraCMS/commit/ede38eb06e0becbee9f19190ebf3ada90a369eb0 patch
https://github.com/doramart/DoraCMS/blob/70cf0fc6dba66ec51747162a3ce71da43baf251b/server/app/service/apiKey.js technical-description
https://vul.yulun.ac.cn/20261102/doracms/ exploit
https://www.vulncheck.com/advisories/doracms-through-3.1.0-mass-assignment-via-api-key-update-endpoint third-party-advisory

https://www.cve.org/CVERecord?id=CVE-2026-120448

IV. Related Vulnerabilities

Same product: DoraCMS

Same vendor: doramart

Same weakness: CWE-915