Executive Summary

A mass assignment vulnerability was discovered in DoraCMS version 3.1.0 and earlier. This vulnerability allows low-privileged users to modify the userId field of their API keys, effectively rebinding the key to another user's account. This could enable attackers to impersonate other users, modify profiles, and publish or delete content.

Technical Analysis

The vulnerability is caused by insufficient input validation and improper access control in the PUT /api/v1/user/api-keys/:id endpoint. Specifically, the endpoint fails to properly validate user input, allowing an attacker to modify the userId field of their API key. This is a mass assignment vulnerability, which is a type of insecure direct object reference (IDOR) vulnerability.

How It Gets Exploited

An authenticated low-privileged user with an existing API key can exploit this vulnerability by sending a crafted PUT request to the /api/v1/user/api-keys/:id endpoint, modifying the userId field to match that of a victim user. Upon successful exploitation, the attacker can then use the victim's account to perform actions such as modifying profiles, publishing content, or deleting content.

Impact Assessment

The vulnerability affects DoraCMS version 3.1.0 and earlier. Successful exploitation could lead to unauthorized modifications to user profiles and content, potentially resulting in data integrity issues and reputational damage. The CVSS score for this vulnerability is 8.1, indicating a high level of severity.

Recommended Actions

To mitigate this vulnerability, users should update DoraCMS to a version beyond 3.1.0. Additionally, administrators should:
  • Monitor API key update requests for suspicious activity.
  • Implement additional access controls to restrict API key modifications.
  • Regularly review and update user permissions to prevent unauthorized access.

Sources

  • National Vulnerability Database (NVD) - CVE-2026-120448
  • GitHub - DoraCMS
  • Vulncheck - DoraCMS Mass Assignment Vulnerability