Dolibarr ERP CRM EUVD-2026-26826

Exploitation requires (1) authenticated API access to Dolibarr - the attacker must possess valid API credentials or an authenticated session token, (2) the Shipments API endpoint must be accessible over the network (typically enabled by default but may be restricted by network policies), (3) the fields parameter must be exposed and unsanitized in the _checkValForAPI function when processing API requests to htdocs/expedition/class/expedition.class.php. The vulnerability does NOT require special configuration or non-default settings; any stock Dolibarr installation with the Shipments API enabled and an authenticated user is vulnerable. Attack complexity is high (AC:H), suggesting the SQL injection payload requires careful crafting or knowledge of the underlying database schema to be useful. Exploitation is limited to read and write access within the database context of the Dolibarr application user (typically restricted database account).

CVSS score of 5.0 with AC:H (high complexity) and PR:L (requires authenticated access) indicates a moderate-severity vulnerability with significant exploitation barriers. The EPSS metric is not provided, but the combination of authenticated requirement and high attack complexity suggests real-world exploitation is constrained. However, several risk factors elevate concern: (1) publicly available exploit code exists (E:P), (2) the vendor did not respond to early disclosure, indicating no security commitment, (3) SQL injection in an ERP system can expose sensitive financial and operational data. The CVSS vector shows confidentiality, integrity, and availability impact (C:L/I:L/A:L) - all low but present. This is NOT a critical priority requiring emergency patching, but organizations with Dolibarr instances exposed to untrusted authenticated users should prioritize remediation. The real risk depends on deployment: if Shipments API is restricted to trusted internal users only, risk is minimal; if exposed to partner portals or less-vetted accounts, exploitation becomes feasible.

An authenticated user with API access credentials (obtained via credential stuffing, insider threat, or authorized account compromise) crafts a malicious HTTP request to the Shipments API with a specially-crafted SQL payload in the fields parameter. The payload bypasses the vulnerable _checkValForAPI function validation and executes arbitrary SQL against the Dolibarr database. The attacker extracts sensitive data such as customer records, financial transactions, or supplier information, or modifies shipment records to redirect goods or alter financial records.