DoraCMS through 3.1.0 Mass Assignment via API Key Update Endpoint

Summary

DoraCMS through 3.1.0 contains a mass assignment vulnerability in the PUT /api/v1/user/api-keys/:id endpoint that allows authenticated low-privileged users to rebind their API key to another user's account. Attackers can set the userId field on their own key to a victim's id, then act as that victim to modify profiles and publish or delete content.

Remediation

1. Inventory every doramart DoraCMS deployment, including staging.
2. No fixed version appears in the public sources yet. Check the references below and the vendor directly.

References

• Patchhttps://github.com/doramart/DoraCMS/commit/ede38eb06e0becbee9f19190ebf3ada90a369eb0
• Advisoryhttps://www.vulncheck.com/advisories/doracms-through-3.1.0-mass-assignment-via-api-key-update-endpoint
• Referencehttps://github.com/doramart/DoraCMS/blob/70cf0fc6dba66ec51747162a3ce71da43baf251b/server/app/service/apiKey.js
• Referencehttps://vul.yulun.ac.cn/20261102/doracms/