CVE-2026-120448
DoraCMS through 3.1.0 contains a mass assignment vulnerability in the PUT /api/v1/user/api-keys/:id endpoint that allows authenticated low-p
CVSS
8.1
Alto
EPSS
—
KEV
—
Exploit Today
—
0-100
Publicado: 2 nov 2026 · Última mod.: 2 nov 2026 · CWE-915
Sin historial EPSS suficiente todavía.
DoraCMS through 3.1.0 contains a mass assignment vulnerability in the PUT /api/v1/user/api-keys/:id endpoint that allows authenticated low-privileged users to rebind their API key to another user's account. Attackers can set the userId field on their own key to a victim's id, then act as that victim to modify profiles and publish or delete content.
- github.comhttps://github.com/doramart/DoraCMS/blob/70cf0fc6dba66ec51747162a3ce71da43baf251b/server/app/service/apiKey.js
- github.comhttps://github.com/doramart/DoraCMS/commit/ede38eb06e0becbee9f19190ebf3ada90a369eb0
- vul.yulun.ac.cnhttps://vul.yulun.ac.cn/20261102/doracms/
- www.vulncheck.comhttps://www.vulncheck.com/advisories/doracms-through-3.1.0-mass-assignment-via-api-key-update-endpoint
CVECVSSEPSSKEVRExplotTítuloVis.
CVE-2026-1195654.3 MED23.8%
——7Plausible Analytics through 3.2.1 contains a mass assignment vulnerability in update_traffic_change_notification that allows authenticated site editors to reassign notifications by supplying a site_id parameter. Attackers can submit traffic_change_notification[site_id] set to another site's primary key via PUT /sites/:domain/traffic-change-notification/:type to receive that site's traffic alerts and visitor figures.3dCVE-2026-114573—15.8%
——5Improperly Controlled Modification of Dynamically-Determined Object Attributes vulnerability in Drupal Monster Menus allows Object Injection. This issue affects Monster Menus versions: from 0.0.0 to 9.5.6.3dCVE-2026-1072499.8 CRÍ33.7%
——10Improperly Controlled Modification of Dynamically-Determined Object Attributes vulnerability in Drupal Block AJAX allows Object Injection. This issue affects Block AJAX versions: from 0.0.0 to 3.0.2.3dCVE-2026-908639.1 CRÍ51.4%
——15Missing authorization in the administrative interface of Progress Software WS_FTP Server versions prior to 2024.0.7 and 2025.0.4 on Windows could allow a delegated Host Administrator to exceed their authorized scope, potentially enabling arbitrary command execution with elevated privileges and complete compromise of the underlying server.3dCVE-2026-1185385.5 MED22.6%
——7A vulnerability was determined in a2ui-project a2ui up to 0.12.0. This issue affects the function Root.renderComponentTree of the file src/0.8/ui/root.js of the component Renderer. Executing a manipulation can lead to dynamically-determined object attributes. The attack may be launched remotely. The pull request to fix this issue awaits acceptance.4dCVE-2026-582558.8 ALT35.8%
——11Cronicle is a multi-server task scheduler and runner, with a web based front-end UI. Prior to 0.9.121, a non-administrator user or scoped API key with `create_events` and `run_events` privileges can inject top-level `uid` and `gid` fields through `/api/app/create_event` or `/api/app/update_event`. In `lib/api.js`, `requireValidEventData` uses `validateOptionalParams` as a partial allow-list that silently passes unknown keys, storing the injected fields verbatim. In `lib/job.js`, `launchJob` copies the whole event into the job, and a plugin `uid` overrides the event `uid` only when the plugin defines one. The default `shellplug` and `urlplug` plugins do not define a `uid`, so the event-controlled identity survives into child-process launch. On a root-daemon installation, this lets a low-privileged user run jobs as arbitrary users, including root, bypassing the otherwise administrator-only run-as-user control. This API-side event injection is distinct from the job-output `uid`/`gid` injection addressed by CVE-2026-39401. This issue is fixed in version 0.9.121.5d