Dolibarr ERP CRM EUVD-2026-109810

Requires an authenticated Dolibarr REST API account holding the societe/creer (third-party creation) permission; the attacker injects via the 'type' field when creating a bank account through the third-party bankaccounts REST endpoint, which reaches the unescaped concatenation in CompanyBankAccount::create(). Exploitation is limited to deployments running Dolibarr 19.0.0 up to (not including) 23.0.4 with the REST API enabled and reachable, and the attacker must already possess valid credentials with that specific permission - there is no unauthenticated or UI-less-anonymous path. Because the leak uses time-based blind subqueries, extraction of password hashes and API keys is slow but does not depend on any non-default configuration beyond having the API active.

This is a genuine but conditional priority, not a drive-by threat. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N) and the 7.2 base score agree with the description: exploitation is network-reachable and low-complexity, but requires an authenticated account - specifically a user holding the societe/creer (third-party create) permission. That PR:L requirement is the single biggest risk-limiter, so this is a privilege-escalation / data-exposure risk from semi-trusted insiders or compromised low-tier API credentials, not an anonymous internet attack. No EPSS score, KEV listing, or confirmed public exploit is present in the input, so there is no evidence of active exploitation - the only exploitation signal is the vuln.today 'this_week' priority label and the VulnCheck advisory. Confidence in the mechanism is high because the vendor commit directly confirms the root cause (unescaped $this->type concatenated into an INSERT in CompanyBankAccount::create()). The impact is primarily confidentiality (VC:H - reading password hashes and API keys via blind subqueries), with limited integrity/availability (VI:L/VA:L). Net: a real, patch-worthy issue warranting prompt remediation on the vendor's this_week timeline, but gated behind authentication rather than a critical unauthenticated emergency.

An attacker who already holds a low-privilege Dolibarr account with societe/creer permission (or who has stolen such an API key) sends a crafted POST to the third-party bankaccounts REST endpoint, placing a time-based blind SQL payload in the 'type' field. Because the value is concatenated unescaped into the INSERT statement in CompanyBankAccount::create(), the attacker uses conditional time delays to exfiltrate stored password hashes and API keys from the database. No public exploit identified at time of analysis, though VulnCheck has published an advisory and the vulnerable code is visible in the public repository.