CVE-2026-120448
High · 8.1CVSS
8.1
EPSS
0.4%
Published
Nov 2, 2026
CISA due date
—
The record
DoraCMS through 3.1.0 contains a mass assignment vulnerability in the PUT /api/v1/user/api-keys/:id endpoint that allows authenticated low-privileged users to rebind their API key to another user's account. Attackers can set the userId field on their own key to a victim's id, then act as that victim to modify profiles and publish or delete content.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|
Related vulnerabilities
- CVE-2026-119565 Plausible Analytics through 3.2.1 contains a mass assignment vulnerability in… CWE-915
- CVE-2026-114573 Improperly Controlled Modification of Dynamically-Determined Object Attributes… CWE-915
- CVE-2026-107249 Improperly Controlled Modification of Dynamically-Determined Object Attributes… CWE-915
- CVE-2026-90863 Missing authorization in the administrative interface of Progress Software WS_FTP Server… CWE-915
- CVE-2026-118538 A vulnerability was determined in a2ui-project a2ui up to 0.12.0. CWE-915
- CVE-2026-58255 Cronicle is a multi-server task scheduler and runner, with a web based front-end UI. CWE-915
- CVE-2026-116216 MacCMS v10 through 2026.1000.4056 contains a mass assignment vulnerability in… CWE-915
- CVE-2026-115933 Postiz signs its session, invitation and password reset tokens with one shared secret and… CWE-915