DoraCMS API key update lets attackers take over other users' accounts
A website management tool lets ordinary members take over others' accounts.
Summary
A mass assignment flaw in DoraCMS's API key update endpoint lets a low-privileged user rebind their key to another user's account. The attacker can then change the victim's profile and publish or delete content as them. Versions through 3.1.0 are affected.
Affected when
- An attacker holds an account on the site (any low-privileged user)
What to do
Check that the product runs a version newer than 3.1.0, and read the vendor's advisory. No fixed version is named in the sources.
Products and platforms
CVE IDs
Sources
Times
First published
First seen