Improper Authentication Vulnerability in Doramart DoraCMS Email API
CVE-2026-3794

6.9MEDIUM

Key Information:

Vendor

Doramart

Status
Doracms
Vendor
CVE Published:
9 March 2026

What is CVE-2026-3794?

A vulnerability exists in the Email API component of Doramart DoraCMS 3.0.x, which allows for improper authentication due to unvalidated processing in the /api/v1/mail/send file. This weakness facilitates remote exploitation, making it critical for users and administrators of this software to be aware of potential threats. The exploit for this vulnerability is publicly accessible, and prompt action is recommended to mitigate risks.

Affected Version(s)

DoraCMS 3.0.*

References

https://vuldb.com/?id.349761
vdb-entrytechnical-description
https://vuldb.com/?ctiid.349761
signaturepermissions-required
https://vuldb.com/?submit.768239
third-party-advisory

CVSS V4

Score:
6.9
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

zsmaaa (VulDB User)
VulDB
.