Dolibarr ERP CVE-2026-11619

Q: What is the CVSS score of CVE-2026-11619?

CVE-2026-11619 has a CVSS 4.0 base score of 2.1 (Low). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-35294 LOW

Incorrect Privilege Assignment (CWE-266)

2026-06-09 cna@vuldb.com

GHSA-2m47-wrp6-46m6

PHP Information Disclosure

2.1

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

2.1 LOW

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Source Code Evidence Fetched

Jun 09, 2026 - 03:31 vuln.today

Analysis Generated

Jun 09, 2026 - 03:31 vuln.today

DescriptionCVE.org

A vulnerability was identified in Dolibarr ERP CRM up to 23.0.2. The impacted element is an unknown function of the file htdocs/core/filemanagerdol/connectors/php/config.inc.php of the component Legacy Filemanager. The manipulation leads to improper authorization. It is possible to initiate the attack remotely. The exploit is publicly available and might be used. Upgrading to version 23.0.3 is sufficient to resolve this issue. The identifier of the patch is f1b2dd6481e22cacb561d29ffdcd3a50b618479d. Upgrading the affected component is advised.

AnalysisAI

Dolibarr ERP CRM's Legacy Filemanager component exposes its configuration endpoint without any authorization gate, allowing authenticated users holding only low-level privileges to interact with filemanager functionality reserved for website administrators. Affecting all releases through 23.0.2, the missing permission check in htdocs/core/filemanagerdol/connectors/php/config.inc.php means any valid account - regardless of role - can reach this endpoint. Publicly available exploit code exists (CVSS E:P); no CISA KEV listing is confirmed in the available data.

Technical ContextAI

Dolibarr ERP CRM is an open-source PHP-based ERP and CRM platform. The Legacy Filemanager (filemanagerdol) is a bundled file-management subsystem whose connector configuration file (htdocs/core/filemanagerdol/connectors/php/config.inc.php) and connector.php process file-operation requests within the application. CWE-266 (Incorrect Privilege Assignment) describes the root cause: prior to 23.0.3 the connector configuration context was loaded with no check validating whether the requesting session held the 'website.write' permission or super-admin status. The patch (commit f1b2dd6481e22cacb561d29ffdcd3a50b618479d) inserts a PHP guard block that calls accessforbidden() unless the user is a super-admin or holds 'website.write'. The CVSS 4.0 vector AV:N/AC:L/AT:N/PR:L/UI:N confirms the endpoint is network-reachable, requires no special attack conditions, and is exploitable by any authenticated low-privilege account without user interaction.

RemediationAI

Upgrade Dolibarr ERP CRM to version 23.0.3, which is the vendor-released patch and is confirmed to resolve this issue via commit f1b2dd6481e22cacb561d29ffdcd3a50b618479d. The patch and release are available at https://github.com/Dolibarr/dolibarr/releases/tag/23.0.3 and https://github.com/dolibarr/dolibarr/commit/f1b2dd6481e22cacb561d29ffdcd3a50b618479d. If immediate upgrade is not feasible, restrict web server access to the htdocs/core/filemanagerdol/ directory at the HTTP layer (e.g., via Apache .htaccess require directives or an nginx location deny block limited to trusted IP ranges); note this will disable the Legacy Filemanager feature entirely for all users. Alternatively, if the Legacy Filemanager is not actively used, disabling or removing the module in Dolibarr's module configuration eliminates the attack surface with no functional impact on unrelated modules.