{"id":"CVE-2026-120448","kind":"vulnerability","aliases":["CVE-2026-120448"],"related":[],"title":"DoraCMS: mass assignment lets low-privileged users take over other accounts","description":"DoraCMS through 3.1.0 contains a mass assignment vulnerability in the PUT /api/v1/user/api-keys/:id endpoint that allows authenticated low-privileged users to rebind their API key to another user's account. Attackers can set the userId field on their own key to a victim's id, then act as that victim to modify profiles and publish or delete content.","summary":"DoraCMS through 3.1.0 lets an authenticated low-privileged user change the userId on their own API key to another user's id. The attacker can then act as that victim to edit profiles and publish or delete content.","severity":"high","cvss":8.6,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"DoraCMS","fixed":[],"affected":"<= 3.1.0 (before commit ede38eb0)","ecosystem":"npm"}],"ecosystems":[],"tags":["doracms","node.js","package","self-hosted"],"not_affected_if":["no-api-keys","no-public-registration"],"how_to_check":"- Check your DoraCMS checkout: affected if it is 3.1.0 or earlier (researcher: 3.0.x to 3.1, commit 70cf0fc) and lacks commit ede38eb0 (git branch --contains ede38eb0).\n- In server/app/service/apiKey.js, updateApiKey is vulnerable if it builds updateData with ...data; fixed if it loops over an allowlist of fields.\n- Look in access logs for PUT /api/v1/user/api-keys/:id with a userId in the body, and for API keys whose userId differs from their creator.","fix":"No released version named in sources. Fixed in git commit ede38eb06e0becbee9f19190ebf3ada90a369eb0 (server/app/service/apiKey.js now only accepts name, permissions, ipWhitelist, rateLimit, expiresAt). Update to a build containing that commit.","status":"open","published_at":"2026-11-02T15:17:27+00:00","first_seen_at":"2026-11-02T15:24:02+00:00","triaged_at":"2026-11-02T15:25:52+00:00","updated_at":"2026-11-02T15:27:29+00:00","category":"package","confidence":0.8,"triage":{"at":"2026-11-02T15:25:52Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"DoraCMS: mass assignment lets low-privileged users take over other accounts","impact":"medium","summary":"DoraCMS through 3.1.0 lets an authenticated low-privileged user change the userId on their own API key to another user's id. The attacker can then act as that victim to edit profiles and publish or delete content.","audience":"businesses","category":"package","nicknames":[],"who_cares":["doracms","self-hosted","node.js"],"confidence":0.7,"fix_status":"unknown","needs_auth":"yes","worst_case":"attacker impersonates another user and publishes or deletes content","analyst_note":"Confirm the fixed version and whether the patch link (github.com) names one; sources state no fixed version.","how_to_check":"- Check the installed DoraCMS version in `package.json` against the range `through 3.1.0`\n- Look for the route `PUT /api/v1/user/api-keys/:id` in the application code or access logs","plain_action":"","needs_analyst":true,"not_affected_if":["no-api-keys","no-public-registration"],"who_is_affected":"Any DoraCMS instance at version 3.1.0 or earlier where users can log in with a low-privileged account and create API keys. The exposed path is the API key update endpoint, so instances with no user registration or without API keys enabled are less exposed. Teams running only a patched or newer release can skip it.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.00068,"input_tokens":4192,"output_tokens":521,"severity_before":"high"},"analyst_status":"done","analyst_note":"Confirm the fixed version and whether the patch link (github.com) names one; sources state no fixed version.","search":"'-120448':15A,18A '-2026':14A,17A '/api/v1/user/api-keys':76C '3.1.0':28B,67C 'account':12A,95C 'act':53B,112C 'allow':80C 'anoth':45B,92C 'api':42B,89C 'assign':3A,71C 'attack':50B,96C 'authent':31B,81C 'chang':36B 'contain':68C 'content':64B,123C 'cve':13A,16A 'delet':63B,122C 'doracm':1A,20B,26B,65C 'doracms':19A 'edit':58B 'endpoint':78C 'field':101C 'host':25B 'id':48B,77C,110C 'key':43B,90C,105C 'let':4A,29B 'low':6A,33B,83C 'low-privileg':5A,32B,82C 'mass':2A,70C 'modifi':117C 'node.js':21B 'packag':22B 'privileg':7A,34B,84C 'profil':59B,118C 'publish':61B,120C 'put':75C 'rebind':87C 'self':24B 'self-host':23B 'set':98C 'take':9A 'user':8A,35B,46B,85C,93C 'userid':38B,100C 'victim':56B,108C,115C 'vulner':72C","nicknames":[],"mitigations":[],"who_affected":"Any self-hosted DoraCMS instance up to 3.1.0 where an attacker can hold an ordinary account and create API keys. They can rebind their key to another user's id and then read or edit that user's profile and publish or delete content as them. Instances without user registration or with API keys unavailable are less exposed; builds containing commit ede38eb0 can skip it.","tier":"B","verified":{"fix":{"at":"2026-11-02T15:27:29Z","by":"analyst","doc":"https://github.com/doramart/DoraCMS/commit/ede38eb06e0becbee9f19190ebf3ada90a369eb0","run_id":1380}},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":["doracms"],"ptokens":["doracms"],"labels":["doracms","high","nodejs","package","selfhosted"],"first_public_at":"2026-11-02T15:17:27+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":1,"sources":[{"source":"nvd","external_id":"CVE-2026-120448","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-120448","severity":null,"published_at":"2026-11-02T15:17:27+00:00","modified_at":"2026-11-02T15:17:27+00:00","first_seen_at":"2026-11-02T15:24:02+00:00","fetched_at":"2026-11-02T15:24:02+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-120448:1380","url":null,"severity":null,"published_at":"2026-11-02T15:27:29+00:00","modified_at":"2026-11-02T15:27:29+00:00","first_seen_at":"2026-11-02T15:27:29+00:00","fetched_at":"2026-11-02T15:27:29+00:00","note":"Maintainer commit ede38eb0 (2026-11-02) allowlists name/permissions/ipWhitelist/rateLimit/expiresAt in apiKey.js updateApiKey; no tagged release names a fix, so fix is the commit. Researcher report has public PoC (affected 3.0.x to 3.1, commit 70cf0fc); no exploitation reported."}],"documents":[{"id":52485,"url":"https://github.com/doramart/DoraCMS/commit/ede38eb06e0becbee9f19190ebf3ada90a369eb0","title":"DoraCMS commit ede38eb: restrict API key update fields","kind":"release","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":52486,"url":"https://www.vulncheck.com/advisories/doracms-through-3.1.0-mass-assignment-via-api-key-update-endpoint","title":"Third-party advisory: www.vulncheck.com","kind":"advisory","source":"nvd","publisher":"research","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Third-party advisory: www.vulncheck.com"},{"id":52615,"url":"https://vul.yulun.ac.cn/20261102/doracms/","title":"DoraCMS Vulnerability Report (Wu Yulun)","kind":"poc","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"poc","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}