DoraCMS: Mass assignment in user API key management (CVE-2026-120448)

DoraCMS through version 3.1.0 contains a mass assignment vulnerability in the PUT /api/v1/user/api-keys/:id endpoint. An authenticated, low-privileged user can manipulate the 'userId' field in a PUT request to associate their own API key with a victim's account. This allows the attacker to impersonate the victim, enabling unauthorized modifications to profiles, content publication, and content deletion.

Impact

Successful exploitation grants an attacker the privileges of a targeted user, which may include administrative rights depending on the victim's account level. This allows for unauthorized profile changes, as well as the deletion or modification of content within the DoraCMS instance.

Recommendation

• Update DoraCMS to the latest available version containing the patch for CVE-2026-120448.
• Review web server access logs for anomalous PUT requests directed at the /api/v1/user/api-keys/ endpoint.
• Audit existing API key ownership and monitor for unexpected changes in key-to-user mappings.