Threats affecting pkg:github/dolibarr/dolibarr

Dolibarr versions before 24.0.2 have an insecure direct object reference (IDOR) vulnerability in the REST Documents API for the ticket module. This flaw allows authenticated API users with ticket read permission to access ticket attachments belonging to other companies by bypassing a company-scope check that is only applied during public ticket authentication sessions, which REST API authentication does not set. Attackers can enumerate ticket identifiers and retrieve sensitive attachments such as invoices and contracts from other parties.

Dolibarr ERP/CRM versions prior to 24.0.2 have a missing authorization vulnerability in the recruitment module that allows unauthenticated attackers to access unpublished draft job positions. Attackers can enumerate job drafts by manipulating the ref parameter to view sensitive details such as titles, descriptions, salary budgets, and recruiter contact information.

Dolibarr ERP CRM versions prior to 24.0.0 contain an OS command injection vulnerability in the htdocs/admin/tools/export.php component. This flaw allows authenticated administrators to bypass the restrict_os_commands allowlist by submitting specially crafted mysqldump values that chain commands using & characters. Successful exploitation enables execution of arbitrary operating system commands with the privileges of the web server user. The vulnerability is fixed in Dolibarr version 24.0.0.

Dolibarr ERP CRM versions 19.0.0 through 23.0.3 contain an SQL injection vulnerability in the third-party bankaccounts REST endpoint. Authenticated API users with societe/creer permission can exploit this flaw by injecting SQL through the 'type' field, potentially allowing them to read sensitive data such as password hashes and API keys via time-based blind subqueries. The vulnerability is fixed in version 23.0.4.

CVE-2026-112361 is a medium severity vulnerability in Dolibarr versions 23.0.0, 23.0.1, and 23.0.2. It involves a protection mechanism failure in an unknown function within the htdocs/document.php file of the CSP component. The vulnerability can be exploited remotely. Upgrading to Dolibarr version 24.0.0 resolves the issue.

Dolibarr 23.0.4 before 24.0.1 ontains an authorization bypass vulnerability that allows unauthenticated attackers to read arbitrary files through the document storage endpoints by supplying a crafted hashp parameter value. Attackers can send a request with hashp=shared to skip token validation while satisfying the authorization condition in htdocs/document.php and htdocs/viewimage.php, gaining access to application logs, uploaded business documents, database backups containing password hashes, and files belonging to other multicompany entities.

Dolibarr 24.0.0 before 24.0.1 contains a case-sensitive denylist bypass vulnerability in the sqlfilters API query parameter that allows authenticated attackers to recover protected database fields by supplying uppercase variants of denylist-protected field names. Attackers can exploit the case-insensitive database column resolution against the case-sensitive denylist check in the core library to use prefix-matching predicates as a boolean oracle and extract full password hashes for any user account, including administrators.

CVE-2026-78160 is an authorization bypass vulnerability in Dolibarr ERP affecting the User Notes Handler component. The flaw involves improper processing of the ID argument in /user/note.php, allowing remote attackers to bypass authorization controls. This vulnerability affects multiple versions up to 18.0.10, 22.0.5, and 23.0.3. Upgrading to versions 23.0.4 or 24.0.0 resolves the issue. The vulnerability has a medium severity rating with a CVSS score of 5.3.

CVE-2026-77686 is an improper authorization vulnerability in Dolibarr affecting versions 23.0.0 through 23.0.4. The flaw exists in the Account Handler component, specifically in the htdocs/user/card.php file, where manipulation of the ID argument can bypass authorization controls. The vulnerability can be exploited remotely without user interaction. A public exploit is available. Upgrading to Dolibarr version 24.0.0 mitigates the issue.

A security flaw has been discovered in Dolibarr up to 23.0.3. Affected is an unknown function of the file htdocs/user/card.php of the component User Cloning. The manipulation of the argument ID results in ldap injection. It is possible to launch the attack remotely. The exploit has been released to the public and may be used for attacks. The patch is identified as 798e65356ede03c2812ab1a728f23fae34de5592. It is advisable to implement a patch to correct this issue.

A vulnerability has been found in Dolibarr ERP up to 23.0.3. Affected is the function fail of the file htdocs/takepos/invoice.php of the component TakePOS Module. Such manipulation leads to missing authorization. The attack may be performed from remote. The name of the patch is 8992ce8704da947b6abe7b65a6fe59aed736bb81. It is advisable to implement a patch to correct this issue.

CVE-2026-11619 is an improper authorization vulnerability in Dolibarr ERP CRM affecting versions 23.0.0 through 23.0.2. The issue exists in an unknown function within the file htdocs/core/filemanagerdol/connectors/php/config.inc.php of the Legacy Filemanager component. This vulnerability can be exploited remotely without user interaction. Upgrading to version 23.0.3 resolves the issue.

CVE-2026-10215 is a medium severity vulnerability in Dolibarr ERP CRM versions 23.0.0 and 23.0.1. It involves improper authorization in the Leave Request REST API component, specifically in the checkUserAccessToObject function within htdocs/holiday/class/api_holidays.class.php. The vulnerability allows remote attackers to bypass authorization checks. A patch is available in version 23.0.2 to address this issue.

CVE-2026-10154 is an authorization bypass vulnerability in Dolibarr ERP CRM versions 23.0.0, 23.0.1, and 23.0.2. The issue arises from manipulation of the ID argument in the htdocs/user/messaging.php file, allowing remote attackers to bypass authorization controls. The vulnerability is fixed by upgrading to version 23.

A remote code execution vulnerability exists in Dolibarr ERP/CRM versions 22.0.0 through 22.0.4 and 24.0.0-alpha via the file htdocs/core/class/commonobject.class.php. The vulnerability allows an unauthenticated attacker to execute arbitrary code on the affected system.

CVE-2026-37712 is a high-severity vulnerability in Dolibarr ERP/CRM versions 22.0.0 through 22.0.4 and 24.0.0-alpha. It allows a remote attacker to execute arbitrary code via the call_user_func_array() function in the htdocs/cron/class/cronjob.class.php file.

An issue in Dolibarr ERP/CRM v.22.0.0 through v.22.0.4 and v.24.0.0-alpha allows a remote attacker to execute arbitrary code via the htdocs/core/actions_addupdatedelete.inc.php

CVE-2026-7689 is a medium-severity vulnerability in Dolibarr ERP CRM versions up to 23.0.2. It involves improper verification of cryptographic signatures in the dol_verifyHash function within the Online Signature Module. The flaw can be exploited remotely but requires high attack complexity and no user interaction. The vendor has not responded to the disclosure, and no official patch or remediation guidance is currently available. Public exploit code has been released, increasing the risk of potential attacks.

In the Website module of Dolibarr ERP & CRM 22.0.4 and below, the application uses blacklist-based filtering to restrict dangerous PHP functions related to system command execution. An authenticated user with permission to edit PHP content can bypass this filtering, resulting in full remote code execution with the ability to execute arbitrary operating system commands on the server.