216.73.217.22

CVE-2026-10154

· Published 31/05/2026 00:16 · Modified 01/06/2026 17:16

Labels: CVE-2026-10154 2026-05-31CVE-2026-10154CWE-285[email protected]

Essential information

Published
31/05/2026 00:16
Modified
01/06/2026 17:16
Author
—
Creator
—
CVSS
5.3 MEDIUM (v3) 5.3 MEDIUM (v4.0)
CISA KEV
No
CWE
—
CVSS vector
—

CVSS metrics

Description

A vulnerability has been found in Dolibarr ERP CRM 23.0.0/23.0.1/23.0.2. The affected element is an unknown function of the file htdocs/user/messaging.php. Such manipulation of the argument ID leads to authorization bypass. The attack can be executed remotely. Upgrading to version 23.0.3 is sufficient to fix this issue. The name of the patch is 119b3606c7a701747a57a1f18b1a9e7666f678e2. It is suggested to upgrade the affected component.

NVD status

Status
Deferred — CVE has been recently published to the CVE List and has been received by the NVD.
Source
[email protected]
NVD
View on NVD

Affected products (CPE)

ProductCPE
dolibarr / dolibarr erp crm cpe:2.3:a:dolibarr:dolibarr_erp_crm:23.0.0-23.0.2:*:*:*:*:*:*:*
dolibarr / dolibarr erp crm cpe:2.3:a:dolibarr:dolibarr_erp_crm:23.0.3:*:*:*:*:*:*:*

References