DoraCMS - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/vendors/doracms/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioMon, 02 Nov 2026 15:51:08 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgDoraCMS: Mass assignment in user API key management (CVE-2026-120448)https://feed.craftedsignal.io/briefs/2026-11-doracms-mass-assignment/Mon, 02 Nov 2026 15:51:08 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-11-doracms-mass-assignment/DoraCMS through version 3.1.0 is vulnerable to a mass assignment flaw in the PUT /api/v1/user/api-keys/:id endpoint, allowing authenticated attackers to rebind API keys to other user accounts and perform unauthorized administrative actions.DoraCMS through version 3.1.0 contains a mass assignment vulnerability in the PUT /api/v1/user/api-keys/:id endpoint. An authenticated, low-privileged user can manipulate the 'userId' field in a PUT request to associate their own API key with a victim's account. This allows the attacker to impersonate the victim, enabling unauthorized modifications to profiles, content publication, and content deletion.

Impact

Successful exploitation grants an attacker the privileges of a targeted user, which may include administrative rights depending on the victim's account level. This allows for unauthorized profile changes, as well as the deletion or modification of content within the DoraCMS instance.

Recommendation

  • Update DoraCMS to the latest available version containing the patch for CVE-2026-120448.
  • Review web server access logs for anomalous PUT requests directed at the /api/v1/user/api-keys/ endpoint.
  • Audit existing API key ownership and monitor for unexpected changes in key-to-user mappings.
]]>highadvisorymass-assignmentprivilege-escalationweb-application