CVE-2026-120448

Description

DoraCMS through 3.1.0 contains a mass assignment vulnerability in the PUT /api/v1/user/api-keys/:id endpoint that allows authenticated low-privileged users to rebind their API key to another user's account. Attackers can set the userId field on their own key to a victim's id, then act as that victim to modify profiles and publish or delete content.

Overview

State: PUBLISHED
Assigner (CNA): VulnCheck
CVSS severity: HIGH
CVSS score: 8.6 / 10
CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N
Effective score: 8.6 / 10 HIGH source: CNA overview
CWE(s): CWE-915
Reserved: 2026-11-02
Published: 2026-11-02 14:29 UTC
Last updated: 2026-11-02 17:32 UTC
Source: https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/120xxx/CVE-2026-120448.json
Linked Threat: CVE-2026-120448 — DoraCMS through 3.1.0 Mass Assignment via API Key Update Endpoint

NVD triage scoring NVD CVE 2.0

Layer NVD adds on top of the CNA's CVE record — published / last-modified timestamps, exploitability / impact subscores, and the FIRST.org EPSS probability that this CVE will be exploited in the wild in the next 30 days.

NVD published: 2026-11-02 15:17:27 UTC
NVD last modified: 2026-11-02 19:35:33 UTC
NVD CVSS v3.1: 8.1 / 10 HIGH source: disclosure@vulncheck.com
NVD CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
Exploitability subscore: 2.8 / 10
Impact subscore: 5.2 / 10

European Union Vulnerability Database ENISA EUVD

ENISA's official EU repository for curated vulnerability intelligence. Carries a separate identifier (EUVD-YYYY-NNNN) and frequently exposes an earlier-published description + CVSS than NVD does.

EUVD ID: EUVD-2026-115208

EUVD enrichment is queued; refresh the page in a few seconds.

Affected products (1)

Vendor	Product	Versions	Platforms
doramart	DoraCMS	`0` (affected)	—

Vendor references (4)

References embedded in the original CVE record by the assigning CNA.

https://github.com/doramart/DoraCMS/commit/ede38eb06e0becbee9f19190ebf3ada90a369eb0 patch
https://vul.yulun.ac.cn/20261102/doracms/ exploit
https://github.com/doramart/DoraCMS/blob/70cf0fc6dba66ec51747162a3ce71da43baf251b/server/app/service/apiKey.js technical-description
VulnCheck Advisory: DoraCMS through 3.1.0 Mass Assignment via API Key Update Endpoint third-party-advisory

MITRE references (4) cveawg.mitre.org

Pulled from MITRE's CVE Services API by the 🛰 Backfill from MITRE button.

https://github.com/doramart/DoraCMS/blob/70cf0fc6dba66ec51747162a3ce71da43baf251b/server/app/service/apiKey.js technical-description
https://github.com/doramart/DoraCMS/commit/ede38eb06e0becbee9f19190ebf3ada90a369eb0 patch
https://vul.yulun.ac.cn/20261102/doracms/ exploit
VulnCheck Advisory: DoraCMS through 3.1.0 Mass Assignment via API Key Update Endpoint third-party-advisory

Web references (0)

DuckDuckGo results ranked by threat-intel / vendor advisory domains. Generated by the 🔎 Find references (web) button above — same flow as the Remediations search.

No web references attached yet.

NVD-tagged references (4)

Reference list NVD curates from the CNA record, vendor advisories, and third-party reports. The tag chips below are NVD's analyst-assigned categories.

https://github.com/doramart/DoraCMS/blob/70cf0fc6dba66ec51747162a3ce71da43baf251b/server/app/service/apiKey.js disclosure@vulncheck.com
https://github.com/doramart/DoraCMS/commit/ede38eb06e0becbee9f19190ebf3ada90a369eb0 disclosure@vulncheck.com
https://vul.yulun.ac.cn/20261102/doracms/ disclosure@vulncheck.com
https://www.vulncheck.com/advisories/doracms-through-3.1.0-mass-assignment-via-api-key-update-endpoint disclosure@vulncheck.com

Remediations (10)

Remediations are stored against the linked Threat row; the list below is deduplicated across both pages.

Microsoft and Adobe Patch Tuesday, September 2026 Security Update ...

web:blog.qualys.com

Microsoft kicks off September with its monthly Patch Tuesday release, delivering fixes for security vulnerabilities affecting its products. The security updates are packed with security fixes…

2026-11-03 08:21 UTC
October 2026 Patch Tuesday...here we go again! - Spiceworks Community

web:community.spiceworks.com

Another record-breaking patch cycle…1408 CVE's , .NET 8 and 9 reach EOS next month (start planning, if you're not already) Microsoft Publisher starts vanishing and place your bets now, on how much breaks between now and next month!

2026-11-03 08:21 UTC
CVE Database Search & Remediation Guidance

web:cvedatabase.com

Search and analyze CVE vulnerabilities with instant access to CVSS scores, affected products, and remediation guidance.

2026-11-03 08:21 UTC
CVE Vulnerabilities 2026: Critical Flaws & Fixes Hub

web:cyberupdates365.com

Track critical CVE vulnerabilities 2026 with verified enterprise patch guides. Fix zero-days across VMware, WordPress, Windows, and cloud infrastructure.

2026-11-03 08:21 UTC
Common Vulnerabilities and Exposures - Wikipedia

web:en.wikipedia.org

The Common Vulnerabilities and Exposures ( CVE ) system, originally Common Vulnerability Enumeration, [1] provides a reference method for publicly known information-security vulnerabilities and exposures. [2] The United States' Homeland Security Systems Engineering and Development Institute FFRDC, operated by The MITRE Corporation, maintains the system, with funding from the US National Cyber ...

2026-11-03 08:21 UTC
What Is CVE Remediation in 2026? - aikido.dev

web:www.aikido.dev

None of these is a clean fix , which is why the decision on how to remediate depends on knowing what package versions are running in production and why. This post will cover how AI has accelerated CVE detection and discovery, the upgrade trap, what CVE remediation actually involves in 2026 , and how to solve the CVE remediation problem.

2026-11-03 08:21 UTC
CVE: Common Vulnerabilities and Exposures

web:www.cve.org

At cve .org, we provide the authoritative reference method for publicly known information-security vulnerabilities and exposures

2026-11-03 08:21 UTC
Patch Tuesday CVE Analysis, Month by Month - Lansweeper

web:www.lansweeper.com

Monthly Microsoft Patch Tuesday breakdowns: actively exploited CVEs , critical fixes, and what to patch first. Every release analyzed by the Lansweeper team.

2026-11-03 08:21 UTC
CVE-2026-12448: Undefined Security Weakness - Rapid7

web:www.rapid7.com

CVE - 2026 -12448: Undefined Security Weakness. View severity, references, and remediation details from Rapid7.

2026-11-03 08:21 UTC
The CVE Database: Curated Vulnerability Intelligence by Wiz | Wiz

web:www.wiz.io

Wiz's CVE Database curates CVE data to create easy-to-navigate profiles that cover the entire vulnerability timeline, exploit scenarios, and mitigation steps.

2026-11-03 08:21 UTC

AI Forensic Analysis

Only Available for Registered Users. Sign in to view.

Raw JSON

The full cvelistV5 record. Download as CVE-2026-120448.json.

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-120448",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-11-02T17:16:18.031755Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-11-02T17:32:38.885Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "DoraCMS",
          "repo": "https://github.com/doramart/DoraCMS",
          "vendor": "doramart",
          "versions": [
            {
              "lessThanOrEqual": "3.1.0",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Wu Yulun"
        },
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "doramart"
        }
      ],
      "datePublic": "2026-11-02T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "DoraCMS through 3.1.0 contains a mass assignment vulnerability in the PUT /api/v1/user/api-keys/:id endpoint that allows authenticated low-privileged users to rebind their API key to another user's account. Attackers can set the userId field on their own key to a victim's id, then act as that victim to modify profiles and publish or delete content."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 8.6,
            "baseSeverity": "HIGH",
            "privilegesRequired": "LOW",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "HIGH"
          },
          "format": "CVSS"
        },
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 8.1,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-915",
              "description": "Improperly Controlled Modification of Dynamically-Determined Object Attributes",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-11-02T14:29:07.455Z",
        "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
        "shortName": "VulnCheck"
      },
      "references": [
        {
          "tags": [
            "patch"
          ],
          "url": "https://github.com/doramart/DoraCMS/commit/ede38eb06e0becbee9f19190ebf3ada90a369eb0"
        },
        {
          "tags": [
            "exploit"
          ],
          "url": "https://vul.yulun.ac.cn/20261102/doracms/"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://github.com/doramart/DoraCMS/blob/70cf0fc6dba66ec51747162a3ce71da43baf251b/server/app/service/apiKey.js"
        },
        {
          "name": "VulnCheck Advisory: DoraCMS through 3.1.0 Mass Assignment via API Key Update Endpoint",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://www.vulncheck.com/advisories/doracms-through-3.1.0-mass-assignment-via-api-key-update-endpoint"
        }
      ],
      "title": "DoraCMS through 3.1.0 Mass Assignment via API Key Update Endpoint",
      "x_generator": {
        "engine": "vulncheck-endgame"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
    "assignerShortName": "VulnCheck",
    "cveId": "CVE-2026-120448",
    "datePublished": "2026-11-02T14:29:07.455Z",
    "dateReserved": "2026-11-02T12:42:19.119Z",
    "dateUpdated": "2026-11-02T17:32:38.885Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}