Dolibarr vulnerabilities
64 CVEs and advisories name Dolibarr as an affected vendor, newest first. Follow it as a feed.
- CVE-2026-125754Dolibarr 20.0.0 through 23.0.4 and 24.x before 24.0.2 IDOR via ExpenseReport Payment API
- CVE-2026-33944Dolibarr: SQL Injection in societe/class/societe.class.php via localtax1_value parameter
- CVE-2026-118754Dolibarr ERP CRM before 24.0.2 Missing Authorization via public recruitment view.php
- CVE-2026-116219Dolibarr ERP CRM before 24.0.0 OS Command Injection via mysqldump Parameter
- CVE-2026-116218Dolibarr ERP CRM 19.0.0 before 23.0.4 SQL Injection via bankaccounts API type field
- CVE-2026-110874Dolibarr before 23.0.4 PHP Object Injection via jsonOrUnserialize()
- CVE-2026-107706Dolibarr before 24.0.2 Incorrect Authorization via updateextrafield.php
- CVE-2026-89013Dolibarr 23.0.4 < 24.0.1 Authorization Bypass via hashp Parameter in document.php
- CVE-2026-89012Dolibarr 24.0.0 < 24.0.1 SQL Filter Denylist Bypass via sqlfilters Parameter
- CVE-2026-82633Dolibarr 10.0.0 before 24.0.0 Missing Authorization on REST Users Groups Endpoint
- CVE-2026-81730Dolibarr 9.0.0 through 23.0.4 Path Traversal via EmailCollector Attachment Filename
- CVE-2026-81729Dolibarr before 23.0.4 Incorrect Authorization on REST API Document Deletion
- CVE-2026-81728Dolibarr before 24.0.0 SQL Injection via the CSV and XLSX Import Update Keys
- CVE-2026-77923Dolibarr 21.0.0 < 24.0.0 Authorization Bypass via clonetasks Mass Action
- CVE-2026-71511Dolibarr < 24.0.0 Members REST API Sensitive Data Exposure via Member Endpoints
- CVE-2026-71510Dolibarr < 24.0.0 Users REST API SQL Injection via filter parameter
- CVE-2026-71509Dolibarr < 24.0.0 Expense Report REST API Improper Authorization via Update Endpoint
- CVE-2026-71508Dolibarr < 24.0.0 REST API Improper Authorization via User Update Endpoint
- CVE-2026-71507Dolibarr < 24.0.0 REST API Broken Object-Level Authorization via Bank Account Routes
- CVE-2026-71506Dolibarr < 24.0.0 Payments REST API Improper Authorization via Delete Endpoint
- CVE-2026-71505Dolibarr < 24.0.0 REST API Broken Object-Level Authorization via Third-Party Write Route
- CVE-2026-71504Dolibarr < 24.0.0 Members REST API Improper Authorization via Password Reset
- CVE-2026-71503Dolibarr < 24.0.0 Reflected XSS via Extra Fields Administration Template
- CVE-2026-78160Dolibarr ERP User Notes note.php authorization
- CVE-2026-19350Dolibarr ERP TakePOS invoice.php fail authorization
- CVE-2026-58376Dolibarr - SQL Injection via sqlfilters Parameter in Multiple REST API List Endpoints
- CVE-2026-11619Dolibarr ERP CRM Legacy Filemanager config.inc.php improper authorization
- CVE-2026-10215Dolibarr ERP CRM Leave Request REST API api_holidays.class.php checkUserAccessToObject improper authorization
- CVE-2026-10154Dolibarr ERP CRM messaging.php authorization
- CVE-2018-25357Dolibarr ERP CRM 7.0.3 Remote Code Execution via install/step1.php