A flaw in the Email API endpoint (/api/v1/mail/send) of doramart DoraCMS 3.0.x allows remote attackers to bypass authentication and perform the API action without proper credentials. The vulnerability is a classic example of CWE‑287, improper authentication, and could lead to unauthorized email sending or other privileged actions within the CMS. Publicly available exploit code indicates that the issue can be leveraged from outside the network, potentially enabling attackers to gain unauthorized access.

The affected product is doramart DoraCMS version 3.0.x. No specific patch or version is listed; the vendor has not published an update or response yet.

The CVSS score of 6.9 places this issue in the Medium severity range, yet the exploit is publicly available and can be initiated remotely. The EPSS score of <1% suggests a low but non‑zero likelihood of exploitation in the wild, and the vulnerability is not currently tracked in the CISA Known Exploited Vulnerabilities catalog. Because the bug involves illegal access to an authenticated API, attackers with knowledge of the endpoint could potentially use it to propagate spam or other malicious content.