Dolibarr ERP CRM CVE-2026-7688

Q: What is the CVSS score of CVE-2026-7688?

CVE-2026-7688 has a CVSS 4.0 base score of 1.3 (Low). CVSS vector: CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-26826 LOW

SQL Injection (CWE-89)

2026-05-03 VulDB

PHP SQLi

1.3

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

1.3 LOW

CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

High

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Severity Changed

May 03, 2026 - 10:22 NVD

MEDIUM LOW

CVSS changed

May 03, 2026 - 10:22 NVD

5.0 (MEDIUM) 1.3 (LOW)

Analysis Generated

May 03, 2026 - 10:15 vuln.today

EUVD ID Assigned

May 03, 2026 - 09:45 euvd

EUVD-2026-26826

Analysis Generated

May 03, 2026 - 09:45 vuln.today

CVE Published

May 03, 2026 - 09:15 nvd

LOW 1.3

DescriptionCVE.org

A vulnerability was identified in Dolibarr ERP CRM up to 23.0.2. This affects the function _checkValForAPI of the file htdocs/expedition/class/expedition.class.php of the component Shipments API Endpoint. The manipulation of the argument fields leads to sql injection. The attack is possible to be carried out remotely. A high degree of complexity is needed for the attack. It is indicated that the exploitability is difficult. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way.

AnalysisAI

SQL injection in Dolibarr ERP CRM up to version 23.0.2 allows authenticated remote attackers to execute arbitrary SQL queries via the fields parameter in the Shipments API Endpoint (_checkValForAPI function). Exploitation requires high attack complexity and authenticated access, with publicly available exploit code confirmed but no active exploitation reported in CISA KEV at time of analysis.

Technical ContextAI

The vulnerability exists in the Shipments API Endpoint component, specifically within the _checkValForAPI function located in htdocs/expedition/class/expedition.class.php. The PHP-based ERP system fails to properly sanitize user-supplied input in the fields parameter before incorporating it into SQL queries, enabling classical SQL injection (CWE-89). The Shipments API is a REST interface used for managing shipment data, and the vulnerable function appears to validate API request payloads without adequate parameterized query protection or input filtering.

RemediationAI

Upgrade Dolibarr ERP CRM to a version newer than 23.0.2; however, no specific patched version is confirmed in the provided data. Contact Dolibarr directly via their security channel or GitHub repository to confirm patched version availability, as the vendor did not respond to the original disclosure. As a temporary compensating control, restrict API access using web application firewall (WAF) rules to block requests containing SQL metacharacters (single quotes, semicolons, OR, UNION, SELECT, etc.) in the fields parameter; this has moderate overhead and may block legitimate API calls with special characters in field names-test thoroughly before production deployment. Alternatively, implement network-level access controls to limit Shipments API exposure to trusted internal networks and partner IPs only, reducing the pool of authenticated attackers who can reach the vulnerable endpoint. If using Dolibarr behind a reverse proxy, disable Shipments API endpoints entirely if unused. Monitor database logs for suspicious SQL patterns and review user accounts with API access privileges.