Is there a patch available for CVE-2026-10154?

Yes, a patch is available for CVE-2026-10154. Update the affected software to the latest version immediately.

Dolibarr ERP CRM CVE-2026-10154

Q: What is the CVSS score of CVE-2026-10154?

CVE-2026-10154 has a CVSS 4.0 base score of 5.3 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-33474 MEDIUM

Authorization Bypass Through User-Controlled Key (CWE-639)

2026-05-30 VulDB

GHSA-5pc3-3f4w-j85m

PHP Authentication Bypass

5.3

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

5.3 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

CVSS changed

May 31, 2026 - 00:22 NVD

4.3 (MEDIUM) 5.3 (MEDIUM)

Source Code Evidence Fetched

May 30, 2026 - 23:51 vuln.today

Analysis Generated

May 30, 2026 - 23:51 vuln.today

DescriptionCVE.org

A vulnerability has been found in Dolibarr ERP CRM 23.0.0/23.0.1/23.0.2. The affected element is an unknown function of the file htdocs/user/messaging.php. Such manipulation of the argument ID leads to authorization bypass. The attack can be executed remotely. Upgrading to version 23.0.3 is sufficient to fix this issue. The name of the patch is 119b3606c7a701747a57a1f18b1a9e7666f678e2. It is suggested to upgrade the affected component.

AnalysisAI

Insecure Direct Object Reference in Dolibarr ERP CRM 23.0.0-23.0.2 allows any authenticated low-privilege user to read another user's messaging records by manipulating the id parameter in htdocs/user/messaging.php. The commit diff confirms the endpoint performed zero ownership or permission validation before serving messaging data - any valid session could enumerate other users' messages by cycling numeric IDs. No public exploit code has been identified and this CVE does not appear in CISA KEV, but the vulnerability is trivially exploitable given its low complexity and minimal authentication barrier.

Technical ContextAI

CWE-639 (Authorization Bypass Through User-Controlled Key) describes the root cause: the PHP endpoint htdocs/user/messaging.php accepted a caller-supplied id parameter and fetched the corresponding user's messaging records without verifying that the requesting user either owned that id or held the user.user.lire (read other users) permission. The patch (commit 119b3606c7a701747a57a1f18b1a9e7666f678e2) inserts an explicit gate - if (($object->id != $user->id) && !$user->hasRight('user', 'user', 'lire')) { accessforbidden(); } - enforcing ownership or elevated permission before rendering. This is a classic IDOR pattern, confirmed explicitly in the 23.0.3 release notes crediting researcher Aksoum Abderrahmane. Affected CPE is cpe:2.3:a:dolibarr:erp_crm:*:*:*:*:*:*:*:* constrained to versions 23.0.0, 23.0.1, and 23.0.2.

RemediationAI

Upgrade Dolibarr ERP CRM to version 23.0.3, which contains the authorization fix delivered via commit 119b3606c7a701747a57a1f18b1a9e7666f678e2. The patched release is available at https://github.com/Dolibarr/dolibarr/releases/tag/23.0.3 and also addresses several additional security fixes in the same release (SSRF via AI module, legacy filemanager permission bypass, cross-customer API object creation). If an immediate upgrade is not feasible, a compensating control is to restrict access to the /user/messaging.php endpoint at the web server or WAF layer so that only accounts with administrator-level roles can reach it - note this will disable the messaging view for all standard users as a side effect. No configuration-only workaround preserving full feature functionality is available.