CVE-2026-107706
MediumCVSS 4.3Exploitation Probability (EPSS)
Low risk9th percentile - higher than 9% of all known CVEs
Summary
Dolibarr ERP CRM before 24.0.2 contains an incorrect authorization vulnerability in htdocs/core/ajax/updateextrafield.php that checks only read permission before writing extrafield values. Authenticated users with read-only access can POST parameters to persistently modify extrafields on viewable third parties, products, members, projects or contacts.
Risk Assessment
Users with limited permissions can modify data in the system, potentially leading to data integrity issues and unauthorized changes to important records.
Recommendation
Upgrade Dolibarr to version 24.0.2 or later immediately and review permissions for read-only users.
Other vulnerabilities in Dolibarr ERP CRM
See all- CVE-2026-37713High
An issue in Dolibarr ERP/CRM versions 22.0.0 through 22.0.4 and 24.0.0-alpha allows a remote attacker to execute arbitrary code via the htdocs/core/class/commonobject.class.php.
- CVE-2026-37712High
An issue in Dolibarr ERP/CRM versions 22.0.0 through 22.0.4 and 24.0.0-alpha allows a remote attacker to execute arbitrary code via the htdocs/cron/class/cronjob.class.php, in the call_user_func_array() function.
- CVE-2026-37711High
An issue in Dolibarr ERP/CRM versions 22.0.0 through 22.0.4 and 24.0.0-alpha allows a remote attacker to execute arbitrary code via the htdocs/core/actions_addupdatedelete.inc.php.
- CVE-2017-17898High
Dolibarr ERP/CRM version 6.0.4 does not block direct requests to *.tpl.php files, allowing remote attackers to obtain sensitive information.
- CVE-2017-9840High
Dolibarr ERP/CRM version 5.0.3 and prior allows low-privilege users to upload files of dangerous types, which can result in arbitrary code execution within the context of the vulnerable application.
- CVE-2018-25357Critical
Dolibarr ERP CRM 7.0.3 contains a remote code execution vulnerability that allows unauthenticated attackers to execute arbitrary code by injecting PHP code through the db_name parameter. Attackers can send a POST request to install/step1.php with malicious PHP code in the db_name parameter, then execute commands via the check.php endpoint using the cmd GET parameter.
- CVE-2026-23500Critical
Dolibarr is an enterprise resource planning (ERP) and customer relationship management (CRM) software package. In versions prior to 23.0.0, the ODT to PDF conversion process in odf.php concatenates the MAIN_ODT_AS_PDF configuration constant directly into a shell command passed to exec() without sanitization.
- CVE-2026-22666High
A vulnerability in Dolibarr ERP/CRM prior to version 23.0.2 allows authenticated attackers with administrator privileges to achieve remote code execution. The issue is in the dol_eval_standard() function, which fails to apply forbidden string checks in whitelist mode and does not detect PHP dynamic callable syntax.
- CVE-2023-38888Critical
A Cross Site Scripting (XSS) vulnerability in Dolibarr ERP CRM version 17.0.1 and earlier allows a remote attacker to obtain sensitive information and execute arbitrary code via the REST API module, related to analyseVarsForSqlAndScriptsInjection and testSqlAndScriptInject functions.
- CVE-2023-38886High
A vulnerability in Dolibarr ERP CRM version 17.0.1 and earlier allows a remote privileged attacker to execute arbitrary code via a crafted command or script.
Original NVD description (English source)
Dolibarr ERP CRM before 24.0.2 contains an incorrect authorization vulnerability in htdocs/core/ajax/updateextrafield.php that checks only read permission before writing extrafield values. Authenticated users with read-only access can POST objectType, objectId, field and value parameters to persistently modify extrafields on viewable third parties, products, members, projects or contacts.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS