Skip to content
Threat Feed
Subscribe

Product

DoraCMS (<= 3.1.0)

1 brief RSS
high advisory

DoraCMS: Mass assignment in user API key management (CVE-2026-120448)

DoraCMS through version 3.1.0 is vulnerable to a mass assignment flaw in the PUT /api/v1/user/api-keys/:id endpoint, allowing authenticated attackers to rebind API keys to other user accounts and perform unauthorized administrative actions.

DoraCMS mass-assignment privilege-escalation web-application
1t 1c