CVE-2026-85401: Improper Access Controls in Dolibarr
Description
A weakness has been identified in Dolibarr up to 21.0.4/22.0.5/23.0.3. Affected by this issue is some unknown functionality of the file htdocs/core/filemanagerdol/connectors/php/config.inc.php of the component Legacy File Manager. Executing a manipulation can lead to improper access controls. The attack can be launched remotely. The exploit has been made available to the public and could be used for attacks. Upgrading to version 23.0.4 can resolve this issue. This patch is called ef6631e9bd5ec4b8cec0e88f1796d3d10dad02ec. It is suggested to upgrade the affected component.
CVSS v4.0
Score 5.3medium
Affected software
Dolibarr
cpe:2.3:a:dolibarr:dolibarr:*:*:*:*:*:*:*:*AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
This vulnerability in Dolibarr's Legacy File Manager component allows remote attackers with low privileges to bypass access controls due to improper access control implementation in the specified PHP configuration file. The issue affects multiple versions up to 23.0.3. The vulnerability has a CVSS 4.0 base score of 5.3 (medium severity) and an exploit is publicly available. The vendor has patched the issue in version 23.0.4, identified by commit ef6631e9bd5ec4b8cec0e88f1796d3d10dad02ec.
Potential Impact
Exploitation of this vulnerability can lead to unauthorized access to functionality or data within the Legacy File Manager component of Dolibarr. The attack can be performed remotely by an attacker with low privileges and does not require user interaction. This may result in partial compromise of confidentiality, integrity, and availability of the affected component.
Mitigation Recommendations
Upgrade Dolibarr to version 23.0.4 or later, which contains the official fix for this vulnerability. This upgrade addresses the improper access control issue in the Legacy File Manager component. No other mitigations are indicated by the vendor advisory.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- VulDB
- Date Reserved
- 2026-09-03T18:25:32.291Z
- Cvss Version
- 4.0
- State
- PUBLISHED
Threat ID: 6a9a327eacd9273b49f0f785
Added to database: 09/04/2026, 02:52:46 UTC
Last enriched: 09/07/2026, 12:01:07 UTC
Last updated: 10/17/2026, 18:48:23 UTC
Views: 81
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.