Which versions of Dolibarr are affected by CVE-2026-58376?

Dolibarr ERP/CRM versions through 23.0.3 contain a SQL injection vulnerability in REST API endpoints that allows authenticated users to extract sensitive database contents, including password hashes…. A patch is available.

Is there a public PoC exploit available for CVE-2026-58376?

Yes, a public proof-of-concept exploit is available for CVE-2026-58376. Prioritise patching immediately. EPSS: 0.2%.

How to fix or mitigate CVE-2026-58376?

24 hours: Audit all Dolibarr deployments to identify affected versions and document REST API user accounts and integration configurations. 7 days: Apply vendor security patch per vendor advisory and rotate all database credentials, API keys, and service account passwords. 30 days: Analyze application logs for REST API endpoint abuse dating to deployment; review access logs for indicators of unauthorized credential use.

Dolibarr CVE-2026-58376

Q: What is the CVSS score of CVE-2026-58376?

CVE-2026-58376 has a CVSS 4.0 base score of 7.2 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.2%.

EUVD-2026-40363 HIGH

SQL Injection (CWE-89)

2026-06-30 VulnCheck

GHSA-2852-jv28-2mv8

PHP Information Disclosure SQLi Dolibarr

7.2

CVSS 4.0 · Vendor: VulnCheck

Severity by source

Vendor (VulnCheck) PRIMARY

7.2 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

7.6 HIGH

Network REST API, low complexity, but requires a valid API account so PR:L; primarily data exfiltration gives C:H with minor I/A impact from injectable SQL.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:L/SC:N/SI:N/SA:N

Primary rating from Vendor (VulnCheck).

CVSS VectorVendor: VulnCheck

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Source Code Evidence Fetched

Jun 30, 2026 - 17:32 vuln.today

Analysis Updated

Jun 30, 2026 - 17:32 vuln.today

v3 (cvss_changed)

Analysis Updated

Jun 30, 2026 - 17:32 vuln.today

v2 (cvss_changed)

Re-analysis Queued

Jun 30, 2026 - 17:22 vuln.today

cvss_changed

CVSS changed

Jun 30, 2026 - 17:22 NVD

7.6 (HIGH) 7.2 (HIGH)

Analysis Generated

Jun 30, 2026 - 17:20 vuln.today

DescriptionCVE.org

Dolibarr through 23.0.3, fixed in commit 14db36e, contains a sql injection vulnerability that allows authenticated API users to exfiltrate arbitrary database contents by supplying malicious values to the sqlfilters query parameter in the setup dictionary and multicurrencies REST API endpoints. The affected endpoints in api_setup.class.php and api_multicurrencies.class.php validate sqlfilters only for balanced parentheses and rewrite matched triplets, allowing text placed outside the expected shape such as an appended UNION SELECT to be concatenated into the SQL WHERE clause unmodified, enabling retrieval of sensitive data including password hashes and API keys.

AnalysisAI

SQL injection in Dolibarr ERP/CRM through version 23.0.3 lets authenticated REST API users exfiltrate arbitrary database contents - including password hashes and API keys - by abusing the sqlfilters parameter on the setup dictionary and multicurrencies list endpoints. The flawed filter only checked for balanced parentheses and rewrote matched triplets, so an appended UNION SELECT placed outside the expected pattern was concatenated into the WHERE clause unmodified. Publicly available exploit code exists and a vendor fix has been committed; the issue is not listed in CISA KEV.

Technical ContextAI

Dolibarr is a PHP-based open-source ERP/CRM whose REST API exposes a 'sqlfilters' query parameter intended to let clients pass a constrained, structured search expression (triplets of the form (field:operator:value)). The pre-fix code in api_setup.class.php (getListOfRegions, getListOfIncoterms, getListOfVAT) and multicurrency/class/api_multicurrencies.class.php (index) called DolibarrApi::_checkFilters(), which validated only that parentheses were balanced, then used preg_replace_callback over the regex '\(([^:'\(\)]+:[^:'\(\)]+:[^\(\)]+)\)' to rewrite recognized triplets. Any text outside that pattern (e.g. a trailing UNION SELECT) passed through untouched and was appended directly into the SQL WHERE clause - a textbook CWE-89 (Improper Neutralization of Special Elements used in an SQL Command) failure rooted in allow-list shape validation rather than true parameterization. The patch replaces this with forgeSQLFromUniversalSearchCriteria(), Dolibarr's centralized, safer query-builder helper.

RemediationAI

Upstream fix available (PR/commit); released patched version not independently confirmed - apply the fix from commit 14db36e (https://github.com/Dolibarr/dolibarr/commit/14db36e8486ef725b0d493d97abb2950a54358d3) via PR #38794 (https://github.com/Dolibarr/dolibarr/pull/38794), which routes sqlfilters through forgeSQLFromUniversalSearchCriteria() instead of the weak _checkFilters()/regex rewrite, or upgrade to the next release that incorporates it once published. If immediate patching is not possible, restrict network access to the Dolibarr REST API (bind to localhost or place behind an authenticated reverse proxy / IP allow-list), and consider disabling or blocking the affected list endpoints (setup dictionaries and multicurrencies) at the proxy layer - note this will break legitimate integrations that consume those endpoints. As a defense-in-depth step, rotate API keys and force password resets after patching, since hashes and keys may already have been exposed; deploy a WAF rule to flag 'UNION'/'SELECT' tokens in the sqlfilters parameter, accepting that WAF filtering is bypassable and is only a stopgap.