An unauthenticated remote authentication bypass vulnerability in doramart DoraCMS 3.0.x poses a significant security risk to affected installations.

This flaw exists within the /api/v1/mail/send endpoint and results from improper authentication handling. It allows an unauthenticated remote attacker to interact with the Email API without verifying credentials.

The vulnerability carries a CVSS score of 7.3, indicating a high level of risk despite the limited impact on confidentiality and integrity. Successful exploitation could lead to unauthorized use of internal mail services, potentially facilitating spam distribution, phishing campaigns, or the compromise of sensitive administrative communication channels.

Immediate Action: As there is no vendor patch currently available, administrators should restrict access to the /api/v1/mail/send endpoint at the network or web server level.

Proactive Monitoring: Review web access logs for unusual traffic patterns or unauthorized requests directed at the /api/v1/mail/send URI.

Compensating Controls: Deploy a Web Application Firewall (WAF) rule to block or challenge requests to the affected API endpoint until a vendor-supplied security update is released.

Public Exploit Available: Yes — a publicly available exploit is referenced in the vulnerability disclosure via VulDB.

Given the confirmed public availability of exploit code and the vendor's lack of response, this vulnerability should be treated with high priority. Organizations using DoraCMS 3.0.x must implement strict access controls on the affected API endpoint immediately to prevent unauthorized exploitation while awaiting a permanent software fix.