DoraCMS versions through 3.1.0 suffer from a mass assignment flaw in the PUT /api/v1/user/api-keys/:id endpoint. An authenticated low‑privileged user can supply a userId field in their request, rebind their API key to another individual's account, and then act as that person to modify profiles or create, publish, or delete content. This grants the attacker full control over the victim's account without needing direct access to the victim's credentials.

The vulnerability affects doramart DoraCMS up to and including version 3.1.0. The flaw resides in the API key update mechanism and is reachable by any user possessing an API key in the system.

The CVSS score of 8.6 classifies this issue as high severity, and its EPSS score is not available, but it is not listed in the CISA KEV catalog. Because the attack requires only authentication to a low‑privileged account—a status that may be common—adversaries can easily exploit the flaw to impersonate victims and perform privileged actions. The attack vector is therefore likely to be an authenticated user targeting the API key endpoint on a compromised or legitimate account.