{"id":"CVE-2026-3794","state":"PUBLISHED","title":"doramart DoraCMS Email API send improper authentication","description":"A vulnerability was identified in doramart DoraCMS 3.0.x. This issue affects some unknown processing of the file /api/v1/mail/send of the component Email API. Such manipulation leads to improper authentication. It is possible to launch the attack remotely. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way.","publishedAt":"2026-03-09T01:32:10.198Z","updatedAt":"2026-03-25T12:33:55.463Z","severity":{"score":6.9,"label":"Medium","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P","source":"VulDB"},"assigner":"VulDB","products":["doramart DoraCMS"],"affected":[{"vendor":"doramart","product":"DoraCMS","versions":[{"version":"3.0.*","status":"affected"}],"modules":["Email API"]}],"references":["https://vuldb.com/?id.349761","https://vuldb.com/?ctiid.349761","https://vuldb.com/?submit.768239"],"weaknesses":["CWE-287"],"ingestedAt":"2026-10-29T20:11:50.837Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2026/3xxx/CVE-2026-3794.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2026-3794","state":"PUBLISHED","datePublished":"2026-03-09T01:32:10.198Z","dateUpdated":"2026-03-25T12:33:55.463Z","assignerShortName":"VulDB","assignerOrgId":"1af790b2-7ee1-4545-860a-a788eba489b5","dateReserved":"2026-03-08T07:31:54.271Z"},"containers":{"cna":{"title":"doramart DoraCMS Email API send improper authentication","descriptions":[{"lang":"en","value":"A vulnerability was identified in doramart DoraCMS 3.0.x. This issue affects some unknown processing of the file /api/v1/mail/send of the component Email API. Such manipulation leads to improper authentication. It is possible to launch the attack remotely. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way."}],"affected":[{"vendor":"doramart","product":"DoraCMS","versions":[{"version":"3.0.*","status":"affected"}],"modules":["Email API"]}],"references":[{"url":"https://vuldb.com/?id.349761","name":"VDB-349761 | doramart DoraCMS Email API send improper authentication","tags":["vdb-entry","technical-description"]},{"url":"https://vuldb.com/?ctiid.349761","name":"VDB-349761 | CTI Indicators (IOB, IOC, IOA)","tags":["signature","permissions-required"]},{"url":"https://vuldb.com/?submit.768239","name":"Submit #768239 | DoraCMS 3.0.x 未授权邮件发送","tags":["third-party-advisory"]}],"metrics":[{"cvssV4_0":{"version":"4.0","baseScore":6.9,"vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P","baseSeverity":"MEDIUM"}},{"cvssV3_1":{"version":"3.1","baseScore":7.3,"vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R","baseSeverity":"HIGH"}},{"cvssV3_0":{"version":"3.0","baseScore":7.3,"vectorString":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R","baseSeverity":"HIGH"}},{"cvssV2_0":{"version":"2.0","baseScore":7.5,"vectorString":"AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:ND/RC:UR"}}],"problemTypes":[{"descriptions":[{"cweId":"CWE-287","type":"CWE","lang":"en","description":"Improper Authentication"}]}],"providerMetadata":{"shortName":"VulDB","orgId":"1af790b2-7ee1-4545-860a-a788eba489b5","dateUpdated":"2026-03-25T12:33:55.463Z"},"timeline":[{"time":"2026-03-08T00:00:00.000Z","lang":"en","value":"Advisory disclosed"},{"time":"2026-03-08T01:00:00.000Z","lang":"en","value":"VulDB entry created"},{"time":"2026-03-15T18:17:05.000Z","lang":"en","value":"VulDB entry last update"}],"credits":[{"lang":"en","value":"zsmaaa (VulDB User)","type":"reporter"},{"lang":"en","value":"VulDB","type":"coordinator"}]},"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"timestamp":"2026-03-10T20:19:28.114883Z","id":"CVE-2026-3794","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2026-03-10T20:19:40.461Z"}}]}}}