Refine your search
2 vulnerabilities found for ERP by Dolibarr
CVE-2026-78160 (GCVE-0-2026-78160)
Vulnerability from cvelistv5
Published
2026-08-24 00:30
Modified
2026-08-24 14:59
Severity ?
VLAI Severity ?
EPSS score ?
Summary
A vulnerability has been found in Dolibarr ERP up to 18.0.10/22.0.5/23.0.3. This issue affects some unknown processing of the file /user/note.php of the component User Notes Handler. The manipulation of the argument ID leads to authorization bypass. The attack can be initiated remotely. Upgrading to version 23.0.4 and 24.0.0 is capable of addressing this issue. The identifier of the patch is 9b5229ef3a9b58d00252d327936b022fb739f149. Upgrading the affected component is advised.
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Dolibarr | ERP |
Version: 18.0.0 Version: 18.0.1 Version: 18.0.2 Version: 18.0.3 Version: 18.0.4 Version: 18.0.5 Version: 18.0.6 Version: 18.0.7 Version: 18.0.8 Version: 18.0.9 Version: 18.0.10 Version: 22.0.0 Version: 22.0.1 Version: 22.0.2 Version: 22.0.3 Version: 22.0.4 Version: 22.0.5 Version: 23.0.0 Version: 23.0.1 Version: 23.0.2 Version: 23.0.3 cpe:2.3:a:dolibarr:erp:*:*:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-78160",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-24T14:59:16.334698Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-24T14:59:25.089Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:a:dolibarr:erp:*:*:*:*:*:*:*:*"
],
"modules": [
"User Notes Handler"
],
"product": "ERP",
"vendor": "Dolibarr",
"versions": [
{
"status": "affected",
"version": "18.0.0"
},
{
"status": "affected",
"version": "18.0.1"
},
{
"status": "affected",
"version": "18.0.2"
},
{
"status": "affected",
"version": "18.0.3"
},
{
"status": "affected",
"version": "18.0.4"
},
{
"status": "affected",
"version": "18.0.5"
},
{
"status": "affected",
"version": "18.0.6"
},
{
"status": "affected",
"version": "18.0.7"
},
{
"status": "affected",
"version": "18.0.8"
},
{
"status": "affected",
"version": "18.0.9"
},
{
"status": "affected",
"version": "18.0.10"
},
{
"status": "affected",
"version": "22.0.0"
},
{
"status": "affected",
"version": "22.0.1"
},
{
"status": "affected",
"version": "22.0.2"
},
{
"status": "affected",
"version": "22.0.3"
},
{
"status": "affected",
"version": "22.0.4"
},
{
"status": "affected",
"version": "22.0.5"
},
{
"status": "affected",
"version": "23.0.0"
},
{
"status": "affected",
"version": "23.0.1"
},
{
"status": "affected",
"version": "23.0.2"
},
{
"status": "affected",
"version": "23.0.3"
},
{
"status": "unaffected",
"version": "23.0.4"
},
{
"status": "unaffected",
"version": "24.0.0"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "Abderrahmane Aksoum (VulDB User)"
}
],
"descriptions": [
{
"lang": "en",
"value": "A vulnerability has been found in Dolibarr ERP up to 18.0.10/22.0.5/23.0.3. This issue affects some unknown processing of the file /user/note.php of the component User Notes Handler. The manipulation of the argument ID leads to authorization bypass. The attack can be initiated remotely. Upgrading to version 23.0.4 and 24.0.0 is capable of addressing this issue. The identifier of the patch is 9b5229ef3a9b58d00252d327936b022fb739f149. Upgrading the affected component is advised."
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P",
"version": "4.0"
}
},
{
"cvssV3_1": {
"baseScore": 6.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C",
"version": "3.1"
}
},
{
"cvssV3_0": {
"baseScore": 6.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C",
"version": "3.0"
}
},
{
"cvssV2_0": {
"baseScore": 6.5,
"vectorString": "AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:OF/RC:C",
"version": "2.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-639",
"description": "Authorization Bypass",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-285",
"description": "Improper Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-24T00:30:10.986Z",
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB"
},
"references": [
{
"name": "VDB-394542 | Dolibarr ERP User Notes note.php authorization",
"tags": [
"vdb-entry",
"technical-description"
],
"url": "https://vuldb.com/vuln/394542"
},
{
"name": "VDB-394542 | CTI Indicators (IOB, IOC, IOA)",
"tags": [
"signature",
"permissions-required"
],
"url": "https://vuldb.com/vuln/394542/cti"
},
{
"name": "CVE-2026-78160 | CVE Analysis and Report",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/cve/CVE-2026-78160"
},
{
"name": "Submit #883067 | dolibarr erp 18.0 User with Self-Edit Rights Can Write to Any Profile(Root + All )",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/submit/883067"
},
{
"tags": [
"issue-tracking"
],
"url": "https://github.com/Dolibarr/dolibarr/issues/39063"
},
{
"tags": [
"issue-tracking",
"patch"
],
"url": "https://github.com/Dolibarr/dolibarr/pull/39123"
},
{
"tags": [
"patch"
],
"url": "https://github.com/Dolibarr/dolibarr/commit/9b5229ef3a9b58d00252d327936b022fb739f149"
},
{
"tags": [
"patch"
],
"url": "https://github.com/Dolibarr/dolibarr/releases/tag/23.0.4"
}
],
"tags": [
"x_open-source"
],
"timeline": [
{
"lang": "en",
"time": "2026-08-23T00:00:00.000Z",
"value": "Advisory disclosed"
},
{
"lang": "en",
"time": "2026-08-23T02:00:00.000Z",
"value": "VulDB entry created"
},
{
"lang": "en",
"time": "2026-08-23T13:48:59.000Z",
"value": "VulDB entry last update"
}
],
"title": "Dolibarr ERP User Notes note.php authorization",
"x_generator": [
"VulDB PVTS v202608"
]
}
},
"cveMetadata": {
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"assignerShortName": "VulDB",
"cveId": "CVE-2026-78160",
"datePublished": "2026-08-24T00:30:10.986Z",
"dateReserved": "2026-08-23T11:43:54.013Z",
"dateUpdated": "2026-08-24T14:59:25.089Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-19350 (GCVE-0-2026-19350)
Vulnerability from cvelistv5
Published
2026-08-09 10:45
Modified
2026-08-10 13:46
Severity ?
5.3 (Medium) - CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N
6.3 (Medium) - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/RL:O/RC:C
6.3 (Medium) - CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/RL:O/RC:C
6.3 (Medium) - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/RL:O/RC:C
6.3 (Medium) - CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/RL:O/RC:C
VLAI Severity ?
EPSS score ?
Summary
A vulnerability has been found in Dolibarr ERP up to 23.0.3. Affected is the function fail of the file htdocs/takepos/invoice.php of the component TakePOS Module. Such manipulation leads to missing authorization. The attack may be performed from remote. The name of the patch is 8992ce8704da947b6abe7b65a6fe59aed736bb81. It is advisable to implement a patch to correct this issue.
References
| URL | Tags | ||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||||||||
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-19350",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-10T13:46:05.316773Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-10T13:46:25.980Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://github.com/Dolibarr/dolibarr/issues/38949"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:a:dolibarr:erp:*:*:*:*:*:*:*:*"
],
"modules": [
"TakePOS Module"
],
"product": "ERP",
"vendor": "Dolibarr",
"versions": [
{
"status": "affected",
"version": "23.0.0"
},
{
"status": "affected",
"version": "23.0.1"
},
{
"status": "affected",
"version": "23.0.2"
},
{
"status": "affected",
"version": "23.0.3"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "Abderrahmane Aksoum (VulDB User)"
}
],
"descriptions": [
{
"lang": "en",
"value": "A vulnerability has been found in Dolibarr ERP up to 23.0.3. Affected is the function fail of the file htdocs/takepos/invoice.php of the component TakePOS Module. Such manipulation leads to missing authorization. The attack may be performed from remote. The name of the patch is 8992ce8704da947b6abe7b65a6fe59aed736bb81. It is advisable to implement a patch to correct this issue."
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X",
"version": "4.0"
}
},
{
"cvssV3_1": {
"baseScore": 6.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:X/RL:O/RC:C",
"version": "3.1"
}
},
{
"cvssV3_0": {
"baseScore": 6.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:X/RL:O/RC:C",
"version": "3.0"
}
},
{
"cvssV2_0": {
"baseScore": 6.5,
"vectorString": "AV:N/AC:L/Au:S/C:P/I:P/A:P/E:ND/RL:OF/RC:C",
"version": "2.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-862",
"description": "Missing Authorization",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-863",
"description": "Incorrect Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-09T10:45:10.818Z",
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB"
},
"references": [
{
"name": "VDB-387189 | Dolibarr ERP TakePOS invoice.php fail authorization",
"tags": [
"vdb-entry",
"technical-description"
],
"url": "https://vuldb.com/vuln/387189"
},
{
"name": "VDB-387189 | CTI Indicators (IOB, IOC, IOA)",
"tags": [
"signature",
"permissions-required"
],
"url": "https://vuldb.com/vuln/387189/cti"
},
{
"name": "CVE-2026-19350 | CVE Analysis and Report",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/cve/CVE-2026-19350"
},
{
"name": "Submit #865736 | Dolibarr ERP 23.0.3 Incorrect Permission Assignment",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/submit/865736"
},
{
"tags": [
"issue-tracking"
],
"url": "https://github.com/Dolibarr/dolibarr/issues/38949"
},
{
"tags": [
"issue-tracking",
"patch"
],
"url": "https://github.com/Dolibarr/dolibarr/pull/38999"
},
{
"tags": [
"patch"
],
"url": "https://github.com/Dolibarr/dolibarr/commit/8992ce8704da947b6abe7b65a6fe59aed736bb81"
}
],
"tags": [
"x_open-source"
],
"timeline": [
{
"lang": "en",
"time": "2026-08-08T00:00:00.000Z",
"value": "Advisory disclosed"
},
{
"lang": "en",
"time": "2026-08-08T02:00:00.000Z",
"value": "VulDB entry created"
},
{
"lang": "en",
"time": "2026-08-08T18:32:29.000Z",
"value": "VulDB entry last update"
}
],
"title": "Dolibarr ERP TakePOS invoice.php fail authorization",
"x_generator": [
"VulDB PVTS v202608"
]
}
},
"cveMetadata": {
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"assignerShortName": "VulDB",
"cveId": "CVE-2026-19350",
"datePublished": "2026-08-09T10:45:10.818Z",
"dateReserved": "2026-08-08T16:27:24.385Z",
"dateUpdated": "2026-08-10T13:46:25.980Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}