CVE-2026-107706
Dolibarr before 24.0.2 Incorrect Authorization via updateextrafield.php
Dolibarr dolibarr
CVSS
5.3MediumExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.20%Chance of exploitation activity in the next 30 days, higher than 8% of CVEs. Scored 23 Oct 2026FIRST EPSS
What fixes it
- 24.0.2dolibarrCVE List
A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.
Description
Dolibarr ERP CRM before 24.0.2 contains an incorrect authorization vulnerability in htdocs/core/ajax/updateextrafield.php that checks only read permission before writing extrafield values. Authenticated users with read-only access can POST objectType, objectId, field and value parameters to persistently modify extrafields on viewable third parties, products, members, projects or contacts.
Text from CVE List
Affected versions 2
- dolibarraffected: all versions before 24.0.2CVE List
- dolibarrunaffected: 24.0.2CVE List
References 4
- github.com/Dolibarr/dolibarr/commit/3420d17b199059ac22fca8b59f23cb8962fc8ef8Fixvia CVE List
- vulncheck.com/advisories/dolibarr-before-24.0.2-incorrect-authorization-via-updateextrafield-phpAdvisoryvia CVE List
- github.com/Dolibarr/dolibarrReferencevia CVE List
- github.com/Dolibarr/dolibarr/blob/24.0.1/htdocs/core/ajax/updateextrafield.php#L80Referencevia CVE List