What is CVE-2026-120448 in DoraCMS?

CVE-2026-120448 is a critical security flaw affecting DoraCMS up to version 3.1.0, carrying a CVSS score of 8.1. For context on critical system flaws, administrators often compare these with CVE-2026-58946: Vulnerabilidad Crítica CVSS 8.4 de Escalada de Privilegios or Vulnerabilidad crítica CVE-2026-115905 con CVSS 10.0 en la librería zip de Rust when reviewing risk vectors.

The vulnerability resides specifically in the mass assignment weakness present within the API key update mechanism detailed in the [[https://github.com/doramart/DoraCMS/blob/70cf0fc6dba66ec51747162a3ce71da43baf251b/server/app/service/apiKey.js|repository reference]].

Who is affected and how does the exploit work?

Authenticated low-privileged users are the primary target group able to exploit this vulnerability. By leveraging improper input handling, standard users can manipulate parameters.

Attackers can set the internal user identifier field on their own generated key to match a target victim's identifier. Following this, they can impersonate the victim to modify user profiles, publish unauthorized content, or delete critical data as outlined in the [[https://www.vulncheck.com/advisories/doracms-through-3.1.0-mass-assignment-via-api-key-update-endpoint|VulnCheck advisory]].

How do I secure my installation against this flaw?

Mitigating this vulnerability requires prompt action from system administrators managing deployments of the content management system.

You should review the [[https://github.com/doramart/DoraCMS/commit/ede38eb06e0becbee9f19190ebf3ada90a369eb0|official commit patch]] to understand the code changes required to block unauthorized parameter binding.

What steps should be taken for remediation?

Applying the vendor patch or modifying the underlying service code is essential to guarantee application security. Similar authorization checks are critical in other software stacks, matching concerns seen in CVE-2026-58957: Vulnerabilidad Crítica CVSS 8.4 de Escalada de Privilegios.

Follow these configuration steps to secure your endpoint:

  1. Clone or access your current DoraCMS source code repository.
  2. Locate the service file handling API key modifications.
  3. Apply the changes from the official commit to sanitize input properties.
  4. Restart your application service to enforce the new input restrictions.