Is there a public PoC exploit available for CVE-2026-10215?

Yes, a public proof-of-concept exploit is available for CVE-2026-10215. Prioritise patching immediately. EPSS: 0.0%.

Is there a patch available for CVE-2026-10215?

Yes, a patch is available for CVE-2026-10215. Update the affected software to the latest version immediately.

Dolibarr ERP CRM CVE-2026-10215

Q: What is the CVSS score of CVE-2026-10215?

CVE-2026-10215 has a CVSS 4.0 base score of 2.1 (Low). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-33536 LOW

Improper Authorization (CWE-285)

2026-06-01 VulDB

GHSA-7fg5-vc77-69fp

PHP Authentication Bypass Dolibarr Erp Crm

2.1

CVSS 4.0 · Vendor: VulDB

Severity by source

Vendor (VulDB) PRIMARY

2.1 LOW

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from Vendor (VulDB) · only source for this CVE.

CVSS VectorVendor: VulDB

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Severity Changed

Jun 01, 2026 - 03:22 NVD

MEDIUM LOW

CVSS changed

Jun 01, 2026 - 03:22 NVD

4.3 (MEDIUM) 2.1 (LOW)

Source Code Evidence Fetched

Jun 01, 2026 - 02:45 vuln.today

Analysis Generated

Jun 01, 2026 - 02:45 vuln.today

DescriptionCVE.org

A security vulnerability has been detected in Dolibarr ERP CRM up to 23.0.1. Impacted is the function checkUserAccessToObject of the file htdocs/holiday/class/api_holidays.class.php of the component Leave Request REST API. The manipulation leads to improper authorization. The attack may be initiated remotely. The exploit has been disclosed publicly and may be used. Upgrading to version 23.0.2 is recommended to address this issue. The identifier of the patch is ee93b6f2f9dd0f6aeefe9d718ab3ab0a44326b73. Upgrading the affected component is advised.

AnalysisAI

Horizontal privilege escalation in Dolibarr ERP CRM through version 23.0.1 permits any authenticated low-privilege user to read other users' leave request records via the Leave Request REST API, with a publicly available proof-of-concept confirming exploitability. The flaw in checkUserAccessToObject within api_holidays.class.php (CWE-285, Improper Authorization) arises because the access control helper receives only an integer object ID rather than the full object, causing ownership validation to fail silently and return another user's confidential HR data. No active exploitation is confirmed in CISA KEV, but the public POC and low attack complexity make this a realistic insider or multi-tenant threat requiring prompt patching.

Technical ContextAI

Dolibarr ERP CRM is a PHP-based open-source enterprise resource planning and CRM platform. The vulnerability exists in the checkUserAccessToObject function within htdocs/holiday/class/api_holidays.class.php, which gates access to Leave Request records via the REST API. The root cause (CWE-285, Improper Authorization) is a systematic misuse of the _checkAccessToResource() helper: callers passed only the integer $object->id rather than the full object instance, and the authorization logic requires the complete object to resolve ownership or entity relationships. The patch commit ee93b6f2f9dd0f6aeefe9d718ab3ab0a44326b73 reveals the same defect was present across the Expense Report API (htdocs/expensereport/class/api_expensereports.class.php) in at least nine separate call sites, indicating a systemic pattern rather than an isolated bug. The base API class (htdocs/api/class/api.class.php) updated its _checkAccessToResource() signature to formally accept int|string|Object as the resource ID parameter, confirming the fix required both API consumers and the base class to be updated. Affected CPE: cpe:2.3:a:dolibarr:erp_crm:*:*:*:*:*:*:*:* covering all versions up through 23.0.1.

RemediationAI

Upgrade Dolibarr ERP CRM to version 23.0.2 or later, which incorporates the vendor-confirmed fix at commit ee93b6f2f9dd0f6aeefe9d718ab3ab0a44326b73 (https://github.com/Dolibarr/dolibarr/releases/tag/23.0.2). The patch corrects _checkAccessToResource() call sites across the Holiday and Expense Report API classes to pass the full object rather than only the integer ID, restoring proper ownership validation. If immediate upgrade is not feasible, restrict access to the Dolibarr REST API endpoint (/api/index.php/) to trusted internal IP ranges via firewall or WAF rules - this reduces attack surface but does not eliminate the flaw for users who legitimately need API access. As a more aggressive compensating control, disable the Leave Request REST API module in Dolibarr's configuration if the API feature is unused; note this will break any integrations or mobile apps that consume the holidays endpoint. Restricting Dolibarr user accounts to the minimum necessary role and ensuring all accounts belong to trusted personnel limits lateral exposure while the patch is staged.