CVE-2026-107706Medium· 4.3▾ SunlitDolibarr ERP CRM before 24.0.2 contains an incorrect authorization vulnerability in htdocs/core/ajax/updateextrafield.php that checks only read permission before writing extrafield values. Authenticated users with read-only access can PO…
▾ Sunlit zone — Low / medium · no exploitation signal
impact 23.7 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake.
Exploit-prediction probability, daily snapshots since Oct 10.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
0.2%
Dolibarr ERP CRM before 24.0.2 contains an incorrect authorization vulnerability in htdocs/core/ajax/updateextrafield.php that checks only read permission before writing extrafield values. Authenticated users with read-only access can POST objectType, objectId, field and value parameters to persistently modify extrafields on viewable third parties, products, members, projects or contacts.
Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-81729Medium· 6.5Dolibarr before 23.0.4 Incorrect Authorization on REST API Document Deletion
CVE-2026-116219High· 7.2Dolibarr ERP CRM before 24.0.0 OS Command Injection via mysqldump Parameter
CVE-2026-116218High· 7.6Dolibarr ERP CRM 19.0.0 before 23.0.4 SQL Injection via bankaccounts API type field
CVE-2026-110874Medium· 6.6Dolibarr before 23.0.4 contains a PHP object injection vulnerability in jsonOrUnserialize() in functions.lib.php, which calls unserialize() without class restrictions when json_decode() fails
CVE-2026-81728High· 8.1Dolibarr before 24.0.0 SQL Injection via the CSV and XLSX Import Update Keys
CVE-2026-81730High· 8.2Dolibarr 9.0.0 through 23.0.4 Path Traversal via EmailCollector Attachment Filename