CVE-2026-120448

DoraCMS through 3.1.0 contains a mass assignment vulnerability in the PUT /api/v1/user/api-keys/:id endpoint that allows authenticated low-privileged users to rebind their API key to another user's account. Attackers can set the userId field on their own key to a victim's id, then act as that...

CVE-2026-120448

DoraCMS versions through 3.1.0 are vulnerable to a mass assignment vulnerability in the PUT /api/v1/user/api-keys/:id endpoint. This flaw allows authenticated low-privileged users to rebind their own API key to a victim's account by manually setting the userId field. Successful exploitation enabl...

CVE-2026-120448 DoraCMS through 3.1.0 Mass Assignment via API Key Update Endpoint

DoraCMS through 3.1.0 contains a mass assignment vulnerability in the PUT /api/v1/user/api-keys/:id endpoint that allows authenticated low-privileged users to rebind their API key to another user's account. Attackers can set the userId field on their own key to a victim's id, then act as that...

EUVD-2026-115208

DoraCMS through 3.1.0 contains a mass assignment vulnerability in the PUT /api/v1/user/api-keys/:id endpoint that allows authenticated low-privileged users to rebind their API key to another user's account. Attackers can set the userId field on their own key to a victim's id, then act as that...

CVE-2026-120448 DoraCMS through 3.1.0 Mass Assignment via API Key Update Endpoint

DoraCMS through 3.1.0 contains a mass assignment vulnerability in the PUT /api/v1/user/api-keys/:id endpoint that allows authenticated low-privileged users to rebind their API key to another user's account. Attackers can set the userId field on their own key to a victim's id, then act as that...

PT-2026-135464

DoraCMS through 3.1.0 contains a mass assignment vulnerability in the PUT /api/v1/user/api-keys/:id endpoint that allows authenticated low-privileged users to rebind their API key to another user's account. Attackers can set the userId field on their own key to a victim's id, then act as that...

CVE-2026-120448: doramart DoraCMS: DoraCMS through 3.1.0 contains a mass assignment vulnerability in the PUT /api/v1/user/api-keys/:id endpoint that…

DoraCMS through 3.1.0 contains a mass assignment vulnerability in the PUT /api/v1/user/api-keys/:id endpoint that allows authenticated low-privileged users to rebind their API key to another user's account. Attackers can set the userId field on their own key to a victim's id, then act as that...

CVE-2026-112887

Gitea Actions task tokens authenticate to the REST API as a shared system user with a negative ID, which repository, organization, project and key filters treated as having no owner restriction, and the token carried no API scope to restrict user-scoped routes. A user who can run a workflow could...

CVE-2026-112887 Gitea Actions task token private repository enumeration

Gitea Actions task tokens authenticate to the REST API as a shared system user with a negative ID, which repository, organization, project and key filters treated as having no owner restriction, and the token carried no API scope to restrict user-scoped routes. A user who can run a workflow could...

CVE-2026-112887

In Gitea , Actions task tokens authenticate to the REST API as a shared system user with a negative ID . Because these tokens lack sufficient API scopes and filters are treated as having no owner restrictions, a user capable of running a workflow can use a job's token to perform a GET /api/v1/use...

EUVD-2026-114791

Gitea Actions task tokens authenticate to the REST API as a shared system user with a negative ID, which repository, organization, project and key filters treated as having no owner restriction, and the token carried no API scope to restrict user-scoped routes. A user who can run a workflow could...

CVE-2026-112887 Gitea Actions task token private repository enumeration

Gitea Actions task tokens authenticate to the REST API as a shared system user with a negative ID, which repository, organization, project and key filters treated as having no owner restriction, and the token carried no API scope to restrict user-scoped routes. A user who can run a workflow could...

CVE-2026-112887: Gitea: Gitea Actions task tokens authenticate to the REST API as a shared system user with a negative ID, which repository,…

Gitea Actions task tokens authenticate to the REST API as a shared system user with a negative ID, which repository, organization, project and key filters treated as having no owner restriction, and the token carried no API scope to restrict user-scoped routes. A user who can run a workflow could...

PT-2026-134867

Name of the Vulnerable Software and Affected Versions Gitea affected versions not specified Description Gitea Actions task tokens authenticate to the REST API as a shared system user with a negative ID. This configuration causes repository, organization, project, and key filters to be treated as...

forgejo-keys-idor

abraxaslabs.tech · github.com/abraxas · @abraxasnull · [email protected] · forgejo-keys-idor Write-up: https://abraxaslabs.tech/research/forgejo-keys-idor forgejo-keys-idor Class: IDOR Reach: Remote Forgejo 16.0.5 8d24b7d - Forgejo GET /api/v1/user/keys/id sits in the current-user group...

CVE-2026-119654

DataCap through 2025.1.1 contains a missing authorization vulnerability that allows any authenticated user to escalate privileges by calling administrative role and menu management APIs. Attackers, including self-registered accounts, can send PUT requests to /api/v1/user/allocationRole to assign...

CVE-2026-119654 DataCap through 2025.1.1 Privilege Escalation via allocationRole Missing Authorization

DataCap through 2025.1.1 contains a missing authorization vulnerability that allows any authenticated user to escalate privileges by calling administrative role and menu management APIs. Attackers, including self-registered accounts, can send PUT requests to /api/v1/user/allocationRole to assign...

CVE-2026-119654 DataCap through 2025.1.1 Privilege Escalation via allocationRole Missing Authorization

DataCap through 2025.1.1 contains a missing authorization vulnerability that allows any authenticated user to escalate privileges by calling administrative role and menu management APIs. Attackers, including self-registered accounts, can send PUT requests to /api/v1/user/allocationRole to assign...

CVE-2026-119654 DataCap through 2025.1.1 Privilege Escalation via allocationRole Missing Authorization

DataCap through 2025.1.1 contains a missing authorization vulnerability that allows any authenticated user to escalate privileges by calling administrative role and menu management APIs. Attackers, including self-registered accounts, can send PUT requests to /api/v1/user/allocationRole to assign...

CVE-2026-119654

DataCap versions through 2025.1.1 are affected by a missing authorization vulnerability (CWE-862). This flaw allows any authenticated user , including self-registered accounts, to perform a privilege escalation attack. By sending PUT requests to the /api/v1/user/allocationRole endpoint, an attack...