DoraCMS vulnerabilities

CVEs whose affected-version data names the DoraCMS package. Each record lists the affected and patched versions; check a specific version with the dependency checker or POST /api/sbom.

1 CVERSS

CVE-2026-120448High· 8.1PoC

6d ago

DoraCMS through 3.1.0 Mass Assignment via API Key Update Endpoint

DoraCMS through 3.1.0 contains a mass assignment vulnerability in the PUT /api/v1/user/api-keys/:id endpoint that allows authenticated low-privileged users to rebind their API key to another user's account. Attackers can set the userId f…

▾ Midnightdoramart · DoraCMSEPSS 0.36%via CVEORG