Dolibarr ERP CRM CVE-2026-10154

A valid authenticated session with any low-privilege Dolibarr account is required (CVSS PR:L confirmed). The attacker must be able to reach the Dolibarr web interface over the network (AV:N) and supply or enumerate valid numeric user IDs within the same instance. The vulnerable feature - the messaging view at htdocs/user/messaging.php - is part of the default Dolibarr installation and requires no special configuration or non-default feature flag to be present. Exploitation is bounded to reading messaging data only; the CVSS I:N and A:N ratings confirm no modification or disruption is possible. Cross-instance access is not possible - the attacker must be an authenticated user of the same Dolibarr deployment.

CVSS 4.3 (Medium) with vector AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N accurately reflects the scope: network-reachable, low complexity, authenticated (low privilege), confidentiality-only impact. No EPSS score was provided in the source data, precluding probabilistic exploitation comparison. This CVE is not listed in CISA KEV, so active exploitation is unconfirmed. Real-world risk is most significant in multi-user or multi-tenant Dolibarr deployments where message confidentiality is assumed - a compromised or malicious low-privilege account (e.g., a salesperson role) could silently harvest messaging records of executives or other staff. The I:N and A:N ratings confirm no data modification or service disruption is possible. The attack requires no special tooling beyond authenticated HTTP requests, so the practical exploitation barrier is low despite the absence of known public exploit code.

An authenticated low-privilege user such as a standard employee or salesperson account logs into Dolibarr and issues HTTP GET requests to htdocs/user/messaging.php?id=<integer>, iterating over user IDs to enumerate and read messaging records belonging to managers, executives, or other staff. No public exploit code has been identified, but the attack requires only awareness of the vulnerability and a valid session - no specialized tools or elevated access are needed given the AC:L rating.