p PatchFirst

CVE-2026-107706

CVE-2026-107706 · Dolibarr before 24.0.2 Incorrect Authorization via updateextrafield.php

This page contains facts from public vulnerability sources. Check the original advisory before updating.

Dolibarr ERP CRM before 24.0.2 contains an incorrect authorization vulnerability in htdocs/core/ajax/updateextrafield.php that checks only read permission before writing extrafield values. Authenticated users with read-only access can POST objectType, objectId, field and value parameters to persistently modify extrafields on viewable third parties, products, members, projects or contacts.

CVSS 5.3 · Medium · EPSS 0.2% · Fix available

Published
Updated

Stack: system

Affected products and versions

  • dolibarr

    Versions
    • ≥ 0, < 24.0.2: Affected (semver)
    • 24.0.2: Not affected (semver)

    Update to 24.0.2

  • dolibarr Ubuntu:Pro:16.04:LTS

    Versions
    • 3.5.5+dfsg1-2
    • 3.5.7+dfsg1-1
    • 3.5.8+dfsg1-1
    • 3.5.8+dfsg1-1ubuntu1
    • 3.5.8+dfsg1-1ubuntu1+esm1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

Original sources

Check your server →