{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/products/doracms--3.1.0/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:doracms:doracms:*:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":8.1,"id":"CVE-2026-120448"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["DoraCMS (\u003c= 3.1.0)"],"_cs_severities":["high"],"_cs_tags":["mass-assignment","privilege-escalation","web-application"],"_cs_type":"advisory","_cs_vendors":["DoraCMS"],"content_html":"\u003cp\u003eDoraCMS through version 3.1.0 contains a mass assignment vulnerability in the PUT /api/v1/user/api-keys/:id endpoint. An authenticated, low-privileged user can manipulate the 'userId' field in a PUT request to associate their own API key with a victim's account. This allows the attacker to impersonate the victim, enabling unauthorized modifications to profiles, content publication, and content deletion.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation grants an attacker the privileges of a targeted user, which may include administrative rights depending on the victim's account level. This allows for unauthorized profile changes, as well as the deletion or modification of content within the DoraCMS instance.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpdate DoraCMS to the latest available version containing the patch for CVE-2026-120448.\u003c/li\u003e\n\u003cli\u003eReview web server access logs for anomalous PUT requests directed at the /api/v1/user/api-keys/ endpoint.\u003c/li\u003e\n\u003cli\u003eAudit existing API key ownership and monitor for unexpected changes in key-to-user mappings.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-11-02T15:51:08Z","date_published":"2026-11-02T15:51:08Z","id":"https://feed.craftedsignal.io/briefs/2026-11-doracms-mass-assignment/","summary":"DoraCMS through version 3.1.0 is vulnerable to a mass assignment flaw in the PUT /api/v1/user/api-keys/:id endpoint, allowing authenticated attackers to rebind API keys to other user accounts and perform unauthorized administrative actions.","title":"DoraCMS: Mass assignment in user API key management (CVE-2026-120448)","url":"https://feed.craftedsignal.io/briefs/2026-11-doracms-mass-assignment/"}],"language":"en","title":"CraftedSignal Threat Feed - DoraCMS (\u003c= 3.1.0)","version":"https://jsonfeed.org/version/1.1"}