Dolibarr ERP CRM before 24.0.2 contains an incorrect authorization vulnerability in htdocs/core/ajax/updateextrafield.php that checks only read… (CVE-2026-107706)
Description
Dolibarr ERP CRM versions before 24.0.2 have an authorization vulnerability in the updateextrafield.php script. The vulnerability arises because the script checks only read permissions before allowing modifications to extrafield values. This flaw allows authenticated users with read-only access to modify extrafields on various objects such as third parties, products, members, projects, or contacts.
CVSS v3.1
Score 4.3medium
Affected software
pkg:deb/ubuntu/dolibarr?arch=source&distro=esm-apps-legacy/xenialRun on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
Dolibarr ERP CRM prior to version 24.0.2 contains an incorrect authorization vulnerability in the file htdocs/core/ajax/updateextrafield.php. The vulnerability is due to the script verifying only read permissions before permitting write operations on extrafield values. Consequently, authenticated users who have only read access can send POST requests with parameters (objectType, objectId, field, and value) to persistently alter extrafields on viewable entities including third parties, products, members, projects, or contacts. This issue is tracked as CVE-2026-107706 and has a CVSS 3.1 base score of 4.3 (medium severity).
Potential Impact
The vulnerability allows authenticated users with read-only permissions to modify extrafield data on various objects within Dolibarr ERP CRM. This could lead to unauthorized data manipulation, potentially affecting data integrity. There is no indication of confidentiality or availability impact, and no known exploits are reported in the wild.
Mitigation Recommendations
A fix is available in Dolibarr ERP CRM version 24.0.2. Users should upgrade to version 24.0.2 or later to remediate this authorization vulnerability. No additional mitigation guidance is provided by the vendor advisory.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- UBUNTU-CVE-2026-107706
- Osv Schema Version
- 1.7.0
- Ecosystems
- ["Ubuntu:Pro:16.04:LTS"]
- Cvss Version
- 3.1
Threat ID: 6ad3f4db2cdf04f656656cd0
Added to database: 10/17/2026, 22:21:15 UTC
Last enriched: 10/17/2026, 22:33:42 UTC
Last updated: 10/17/2026, 22:33:42 UTC
Views: 3
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.