Dolibarr

Insecure Direct Object Reference in Dolibarr's Users::getGroups REST API endpoint allows any authenticated user to read group memberships of arbitrary users across tenant boundaries without authorization. Versions 10.0.0 through 23.x omit the per-object access check in GET /users/{id}/groups, exposing group names, entity associations, and private notes to any API credential holder. Fixed in 24.0.0; no public exploit or CISA KEV listing identified at time of analysis.

Path traversal via unsanitized MIME attachment filenames in Dolibarr's EmailCollector module allows any email sender to write attacker-controlled files outside the intended attachment directory, affecting versions 9.0.0 through 23.0.4. Because the EmailCollector is designed to ingest mail from unauthenticated external senders - such as a support or ticket inbox - no Dolibarr account is required to exploit this flaw. On hardened deployments with a read-only htdocs tree, the attacker can corrupt or forge documents belonging to other objects; on installations where htdocs is writable, the same write primitive reaches web-executable PHP paths, enabling remote code execution. No public exploit identified at time of analysis.

Incorrect authorization in Dolibarr's REST API before version 23.0.4 allows authenticated users holding only read-level module permissions to permanently delete documents via the DELETE /api/index.php/documents endpoint. The flaw in Documents::delete() at htdocs/api/class/api_documents.class.php passes the mode argument 'read' rather than 'write' to dol_check_secure_access_document(), meaning any API account with societe:lire, facture:lire, or equivalent read-only grants can irrecoverably destroy third-party files, invoices, orders, proposals, project files, and generated PDFs. No public exploit has been identified at time of analysis, but the corrective one-line commit diff is publicly visible on GitHub, making the flaw trivial to weaponize for any holder of low-privilege API credentials.

SQL injection in Dolibarr's CSV and XLSX import wizard (all versions before 24.0.0, including the most recent 23.0.4 stable release) allows an authenticated user holding the import permission to inject arbitrary SQL through the unsanitized updatekeys POST parameter. A crafted UNION SELECT payload simultaneously exfiltrates content from any database table the application account can read and hijacks the WHERE clause of the subsequent UPDATE to redirect which row is overwritten; for category link tables the raw filter array is spliced directly into UPDATE statements. No public exploit has been identified at time of analysis, and this CVE does not appear in the CISA KEV catalog.

Authorization bypass in Dolibarr ERP versions 21.0.0 through 23.x allows authenticated users holding project-creation permission to clone tasks into private projects they are not authorized to access. The flaw is an inverted boolean logic error in the clonetasks mass action handler - `!in_array()` is used where `in_array()` is required, causing the private-project membership check to pass precisely for unauthorized users and fail for authorized ones. No public exploit code exists and this vulnerability is not listed in CISA KEV; however, the low attack complexity (AC:L) means any authenticated user with project-creation rights can trivially abuse the flaw against any private project in the same Dolibarr instance.

Dolibarr's Members REST API before version 24.0.0 exposes bcrypt password hash verifiers to any authenticated user holding member-read rights, enabling offline password cracking attacks against member accounts. Both the member list and individual member detail endpoints return the crypted password verifier field because neither the base API serializer nor the Members API class applies field-level filtering to strip credential material from responses. A public proof-of-concept exists; this is not confirmed as actively exploited via CISA KEV, but the low access bar combined with exposed credential hashes and available exploit code makes this a genuine remediation priority for organizations running affected versions.

SQL injection in Dolibarr's users REST API (all versions before 24.0.0) allows authenticated users holding only user-read rights to exfiltrate sensitive database columns - including salary figures and password verifier hashes - that the API is explicitly designed to withhold from normal responses. The injection path targets unsanitized filter parameters concatenated directly into SQL WHERE clauses with no column-level access gating, enabling blind binary search on numeric fields and LIKE prefix iteration on string fields; raw database error messages in the same endpoint additionally leak internal column names. A publicly available exploit writeup documents the full technique (codeant.ai, VulnCheck); no CISA KEV listing is recorded at time of analysis.

Improper authorization in Dolibarr's expense report REST API update endpoint allows authenticated users with only expense-creation rights to self-approve their own expense reports by directly manipulating workflow state fields, including approval status and approver identity. All Dolibarr versions before 24.0.0 are affected; a publicly available proof-of-concept exploit demonstrates the bypass. While not listed in CISA KEV, the publicly available exploit and the financial integrity impact - including forged audit records and missing approval timestamps - make this a meaningful risk for organizations running Dolibarr for financial operations.

Dolibarr's REST API user-update endpoint permits any low-privileged account holding user-write rights to overwrite payroll fields - salary, bonus, hourly rate, daily rate, and weekly hours - for arbitrary user records, bypassing intended payroll-role access controls. All Dolibarr versions before 24.0.0 are affected due to an incomplete field denylist that fails to exclude payroll columns from mass-assignment in the API layer. A publicly available proof-of-concept exploit exists; no confirmed active exploitation has been recorded in CISA KEV at the time of analysis, but vendor-released patch version 24.0.0 is available.

Broken object-level authorization (BOLA) in Dolibarr's REST API bank account write routes permits any authenticated user holding third-party creation rights to overwrite bank account details - including IBANs - for any company in the system, regardless of whether they have read access to that company. When SEPA credit-transfer files are subsequently regenerated from the tampered records, outgoing supplier payments are silently redirected to attacker-controlled accounts, enabling financial fraud at scale. Publicly available exploit code exists per VulnCheck and codeant.ai research; the vulnerability is not yet listed in CISA KEV but the financial impact potential elevates real-world priority above the 7.1 CVSS score alone suggests.

Incorrect authorization in Dolibarr's payments REST API delete endpoint exposes all payment records to deletion by any authenticated user holding invoice-deletion rights, regardless of whether they possess payment-issuance rights. All Dolibarr installations prior to version 24.0.0 are affected. Exploitation results in permanent removal of payment records, zeroing of paid invoice amounts, and corruption of accounting exports - a high-integrity, high-availability financial data loss. Publicly available exploit code exists, lowering the attack barrier; active exploitation has not been confirmed by CISA KEV at time of analysis.

Broken object-level authorization (BOLA) in Dolibarr's REST API write routes for third-party site accounts allows any authenticated user holding third-party creation rights to overwrite the WebPortal password of any company in the system, regardless of ownership. After replacing the password, the attacker can log into the victim company's WebPortal and access its invoice data; the write endpoint also returns the victim's previous password verifier, enabling potential offline credential attacks. A public proof-of-concept is available; no confirmed active exploitation (CISA KEV) at time of analysis, but the low attack complexity and available PoC make this a genuine priority for all pre-24.0.0 deployments.

Improper authorization in Dolibarr's Members REST API (all versions before 24.0.0) allows any authenticated user holding member-creation rights to overwrite the password of any system account - including the administrator - without possessing password-change permissions. The attacker supplies an arbitrary user identifier and replacement password in the API request body, immediately gaining control of the target account and locking out its legitimate holder. A publicly available proof-of-concept exists; no active exploitation has been confirmed in CISA KEV at the time of analysis.

Reflected XSS in Dolibarr's extra fields administration template (all versions before 24.0.0) allows an unauthenticated attacker to execute arbitrary JavaScript in an authenticated administrator's browser session by delivering a crafted URL containing a malicious `type` parameter. The parameter is echoed without JavaScript-context encoding directly into an inline script block, and no Content-Security-Policy header is present to block the execution. Successful exploitation enables the attacker to create a persistent backdoor administrator account, constituting a full application takeover with no KEV listing but publicly available exploit code confirmed by VulnCheck.

LDAP injection in Dolibarr's User Cloning component (htdocs/user/card.php) through version 23.0.3 allows authenticated remote attackers to manipulate LDAP query logic by crafting the user ID argument. Any valid Dolibarr user with access to the User Cloning feature can exploit this without additional privileges or user interaction. A public exploit has been released on Google Drive, substantially lowering the barrier for abuse; no active exploitation is confirmed in CISA KEV at time of analysis.

SQL injection in Dolibarr ERP/CRM through version 23.0.3 lets authenticated REST API users exfiltrate arbitrary database contents - including password hashes and API keys - by abusing the sqlfilters parameter on the setup dictionary and multicurrencies list endpoints. The flawed filter only checked for balanced parentheses and rewrote matched triplets, so an appended UNION SELECT placed outside the expected pattern was concatenated into the WHERE clause unmodified. Publicly available exploit code exists and a vendor fix has been committed; the issue is not listed in CISA KEV.

A Cross Site Scripting (XSS) vulnerability exists in Dolibarr before 14.0.3 via the ticket creation flow. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.

In “Dolibarr” application, v2.8.1 to v13.0.2 are vulnerable to account takeover via password reset functionality. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity.

In “Dolibarr” application, v3.3.beta1_20121221 to v13.0.2 have “Modify” access for admin level users to change other user’s details but fails to validate already existing “Login” name, while renaming. Rated high severity (CVSS 7.2), this vulnerability is remotely exploitable, low attack complexity.

In “Dolibarr ERP CRM”, WYSIWYG Editor module, v2.8.1 to v13.0.2 are affected by a stored XSS vulnerability that allows low privileged application users to store malicious scripts in the “Private. Rated critical severity (CVSS 9.0), this vulnerability is remotely exploitable, low attack complexity. This Cross-Site Scripting (XSS) vulnerability could allow attackers to inject malicious scripts into web pages viewed by other users.

In “Dolibarr” application, 2.8.1 to 13.0.4 don’t restrict or incorrectly restricts access to a resource from an unauthorized actor. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, low attack complexity.

Dolibarr before 11.0.5 allows low-privilege users to upload files of dangerous types, leading to arbitrary code execution. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.

Dolibarr CRM before 11.0.5 allows privilege escalation. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.

A SQL injection vulnerability in accountancy/customer/card.php in Dolibarr 11.0.3 allows remote authenticated users to execute arbitrary SQL commands via the id parameter. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity.

Dolibarr before 11.0.4 allows XSS. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.

core/get_menudiv.php in Dolibarr before 11.0.4 allows remote authenticated attackers to bypass intended access restrictions via a non-alphanumeric menu parameter. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity.

Dolibarr ERP/CRM through 8.0.3 has /exports/export.php?datatoexport= XSS. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.

SQL Injection vulnerability in Dolibarr before version 7.0.2 allows remote attackers to execute arbitrary SQL commands via the sortfield parameter to /accountancy/admin/accountmodel.php,. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity.

Cross-site scripting (XSS) vulnerability in Dolibarr before 7.0.2 allows remote attackers to inject arbitrary web script or HTML via the foruserlogin parameter to adherents/cartes/carte.php. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity.

SQL injection vulnerability in Dolibarr before 7.0.2 allows remote attackers to execute arbitrary SQL commands via vectors involving integer parameters without quotes. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.

The admin panel in Dolibarr before 7.0.2 might allow remote attackers to execute arbitrary commands by leveraging support for updating the antivirus command and parameters used to scan file uploads. Rated high severity (CVSS 8.0), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available.

SQL injection vulnerability in don/list.php in Dolibarr version 6.0.0 allows remote attackers to execute arbitrary SQL commands via the statut parameter. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity.

Cross-site scripting (XSS) vulnerability in Dolibarr ERP/CRM 6.0.0 allows remote authenticated users to inject arbitrary web script or HTML via the Title parameter to htdocs/admin/menus/edit.php. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity.

There is a sensitive information disclosure vulnerability in document.php in Dolibarr ERP/CRM version 6.0.0 via the file parameter. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Exposure of Sensitive Information vulnerability could allow attackers to access sensitive data that should not be disclosed.

Multiple cross-site scripting (XSS) vulnerabilities in Dolibarr ERP/CRM 6.0.0 allow remote authenticated users to inject arbitrary web script or HTML via the (1) CompanyName, (2) CompanyAddress, (3). Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity.

SQL injection vulnerability in admin/menus/edit.php in Dolibarr ERP/CRM version 6.0.0 allows remote attackers to execute arbitrary SQL commands via the menuId parameter. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity.

Dolibarr ERP/CRM 5.0.3 and prior allows low-privilege users to upload files of dangerous types, which can result in arbitrary code execution within the context of the vulnerable application. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.

Dolibarr ERP/CRM before 5.0.3 is vulnerable to a SQL injection in user/index.php (search_supervisor and search_statut parameters). Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity.

Multiple cross-site scripting (XSS) vulnerabilities in Dolibarr ERP/CRM 3.8.3 allow remote authenticated users to inject arbitrary web script or HTML via the (1) lastname, (2) firstname, (3) email,. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.

Multiple cross-site scripting (XSS) vulnerabilities in Dolibarr ERP/CRM 3.8.3 and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) external calendar url or (2) the. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.

Multiple cross-site scripting (XSS) vulnerabilities in Dolibarr ERP/CRM 3.5 and 3.6 allow remote attackers to inject arbitrary web script or HTML via the Business Search (search_nom) field to (1). Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable. Public exploit code available.

Multiple SQL injection vulnerabilities in Dolibarr ERP/CRM before 3.6.1 allow remote authenticated users to execute arbitrary SQL commands via the (1) contactid parameter in an addcontact action, (2). Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.