Threat Intelligence Database

Dolibarr 23.0.4 before 24.0.1 ontains an authorization bypass vulnerability that allows unauthenticated attackers to read arbitrary files through the document storage endpoints by supplying a crafted hashp parameter value. Attackers can send a request with hashp=shared to skip token validation while satisfying the authorization condition in htdocs/document.php and htdocs/viewimage.php, gaining access to application logs, uploaded business documents, database backups containing password hashes, and files belonging to other multicompany entities.

Dolibarr 24.0.0 before 24.0.1 contains a case-sensitive denylist bypass vulnerability in the sqlfilters API query parameter that allows authenticated attackers to recover protected database fields by supplying uppercase variants of denylist-protected field names. Attackers can exploit the case-insensitive database column resolution against the case-sensitive denylist check in the core library to use prefix-matching predicates as a boolean oracle and extract full password hashes for any user account, including administrators.

A vulnerability has been found in Dolibarr ERP up to 18.0.10/22.0.5/23.0.3. This issue affects some unknown processing of the file /user/note.php of the component User Notes Handler. The manipulation of the argument ID leads to authorization bypass. The attack can be initiated remotely. Upgrading to version 23.0.4 and 24.0.0 is capable of addressing this issue. The identifier of the patch is 9b5229ef3a9b58d00252d327936b022fb739f149. Upgrading the affected component is advised.

CVE-2026-78160 is an authorization bypass vulnerability in Dolibarr ERP affecting the User Notes Handler component. The flaw involves improper processing of the ID argument in /user/note.php, allowing remote attackers to bypass authorization controls. This vulnerability affects multiple versions up to 18.0.10, 22.0.5, and 23.0.3. Upgrading to versions 23.0.4 or 24.0.0 resolves the issue. The vulnerability has a medium severity rating with a CVSS score of 5.3.

CVE-2026-77686 is an improper authorization vulnerability in Dolibarr affecting versions 23.0.0 through 23.0.4. The flaw exists in the Account Handler component, specifically in the htdocs/user/card.php file, where manipulation of the ID argument can bypass authorization controls. The vulnerability can be exploited remotely without user interaction. A public exploit is available. Upgrading to Dolibarr version 24.0.0 mitigates the issue.

A security flaw has been discovered in Dolibarr up to 23.0.3. Affected is an unknown function of the file htdocs/user/card.php of the component User Cloning. The manipulation of the argument ID results in ldap injection. It is possible to launch the attack remotely. The exploit has been released to the public and may be used for attacks. The patch is identified as 798e65356ede03c2812ab1a728f23fae34de5592. It is advisable to implement a patch to correct this issue.

A vulnerability has been found in Dolibarr ERP up to 23.0.3. Affected is the function fail of the file htdocs/takepos/invoice.php of the component TakePOS Module. Such manipulation leads to missing authorization. The attack may be performed from remote. The name of the patch is 8992ce8704da947b6abe7b65a6fe59aed736bb81. It is advisable to implement a patch to correct this issue.

A vulnerability has been found in Dolibarr ERP up to 23.0.3. Affected is the function fail of the file htdocs/takepos/invoice.php of the component TakePOS Module. Such manipulation leads to missing authorization. The attack may be performed from remote. The name of the patch is 8992ce8704da947b6abe7b65a6fe59aed736bb81. It is advisable to implement a patch to correct this issue.

Dolibarr versions through 23.0.3 contain a SQL injection vulnerability in the setup and multicurrencies REST API endpoints. Authenticated API users can exploit this by supplying malicious values to the sqlfilters query parameter, enabling exfiltration of arbitrary database contents including sensitive data such as password hashes and API keys. The vulnerability arises because the endpoints only validate balanced parentheses and rewrite matched triplets, allowing appended SQL code like UNION SELECT to be injected into the SQL WHERE clause. This issue was fixed in commit 14db36e.

CVE-2026-11619 is an improper authorization vulnerability in Dolibarr ERP CRM affecting versions 23.0.0 through 23.0.2. The issue exists in an unknown function within the file htdocs/core/filemanagerdol/connectors/php/config.inc.php of the Legacy Filemanager component. This vulnerability can be exploited remotely without user interaction. Upgrading to version 23.0.3 resolves the issue.