Live › vulnerability › CVE-2026-120448
DoraCMS through 3.1.0 lets an authenticated low-privileged user change the userId on their own API key to another user's id. The attacker can then act as that victim to edit profiles and publish or delete content.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-11-02 15:24 UTC. All times on this page are UTC.
Any self-hosted DoraCMS instance up to 3.1.0 where an attacker can hold an ordinary account and create API keys. They can rebind their key to another user's id and then read or edit that user's profile and publish or delete content as them. Instances without user registration or with API keys unavailable are less exposed; builds containing commit ede38eb0 can skip it.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| DoraCMS | npm | <= 3.1.0 (before commit ede38eb0) | – |
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
DoraCMS through 3.1.0 contains a mass assignment vulnerability in the PUT /api/v1/user/api-keys/:id endpoint that allows authenticated low-privileged users to rebind their API key to another user's account. Attackers can set the userId field on their own key to a victim's id, then act as that victim to modify profiles and publish or delete content.
This page as .md · .json · in your agent: get_signal("CVE-2026-120448")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.