Which versions of Doracms are affected by CVE-2026-3794?

CVE-2026-3794 affects DoraCMS 3.0.x email functionality and poses a HIGH severity risk with a public exploit already available.

Is there a public PoC exploit available for CVE-2026-3794?

Yes, a public proof-of-concept exploit is available for CVE-2026-3794. Prioritise patching immediately. EPSS: 0.2%.

How to fix or mitigate CVE-2026-3794?

Within 24 hours: Identify all systems running DoraCMS 3.0.x and restrict network access to the /api/v1/mail/send endpoint. Within 7 days: Deploy WAF rules to block malicious requests to this API endpoint and enable enhanced logging for security review. Within 30 days: Evaluate alternative email solutions or prepare for immediate patching upon vendor release; contact DoraCMS support for patch timeline.

Doracms CVE-2026-3794

Q: What is the CVSS score of CVE-2026-3794?

CVE-2026-3794 has a CVSS 4.0 base score of 5.5 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.2%.

MEDIUM

Improper Authentication (CWE-287)

2026-03-09 cna@vuldb.com

Authentication Bypass Doracms

5.5

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

5.5 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Severity Changed

Apr 29, 2026 - 01:11 NVD

HIGH MEDIUM

CVSS changed

Apr 29, 2026 - 01:11 NVD

7.3 (HIGH) 5.5 (MEDIUM)

Analysis Generated

Mar 12, 2026 - 21:56 vuln.today

PoC Detected

Mar 10, 2026 - 18:50 vuln.today

Public exploit code

CVE Published

Mar 09, 2026 - 03:15 nvd

HIGH 7.3

DescriptionCVE.org

A vulnerability was identified in doramart DoraCMS 3.0.x. This issue affects some unknown processing of the file /api/v1/mail/send of the component Email API. Such manipulation leads to improper authentication. It is possible to launch the attack remotely. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way.

AnalysisAI

DoraCMS 3.0.x Email API endpoint /api/v1/mail/send contains an authentication bypass vulnerability that allows unauthenticated remote attackers to send emails and potentially access sensitive functionality. Public exploit code exists for this vulnerability, and no patch is currently available from the vendor despite early disclosure notification. The flaw carries a CVSS score of 7.3 with moderate confidentiality, integrity, and availability impact.

Technical ContextAI

Classified as CWE-287 (Improper Authentication). Affects Doracms. A vulnerability was identified in doramart DoraCMS 3.0.x. This issue affects some unknown processing of the file /api/v1/mail/send of the component Email API. Such manipulation leads to improper authentication. It is possible to launch the attack remotely. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way.