GHSA-7fg5-vc77-69fp CVE-2026-10215

Dolibarr ERP CRM is vulnerable to Improper Authorization through its Leave Request REST API

Medium Packagist

Severity: 0.0 / 10; Medium · CVSS 4.0
Exploit chance (EPSS): 0.26%; Chance of exploitation in the next 30 days. Higher than 17.66% of scored vulnerabilities.
Known exploited: No; Not in CISA's catalog
Weakness: CWE-266 Incorrect Privilege Assignment
Fix: None yet; No fixed version published

Description

A security vulnerability has been detected in Dolibarr ERP CRM up to 23.0.1. Impacted is the function checkUserAccessToObject of the file htdocs/holiday/class/api_holidays.class.php of the component Leave Request REST API. The manipulation leads to improper authorization. The attack may be initiated remotely. The exploit has been disclosed publicly and may be used. Upgrading to version 23.0.2 is recommended to address this issue. The identifier of the patch is ee93b6f2f9dd0f6aeefe9d718ab3ab0a44326b73. Upgrading the affected component is advised.

Affected versions

Packagist

Package	Vulnerable	Fixed in
dolibarr/dolibarr	`<= 15.0.3`	No fix yet

How to fix

No fixed version has been published yet. Until one is, remove or replace the package, or turn off or isolate the affected feature. This page updates when a fix ships.

Severity breakdown

CVSS 4.0 0.0

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P

Attack vector: Network
Attack complexity: Low
Attack requirements: None
Privileges required: Low
User interaction: None
Confidentiality (vulnerable system): Low
Integrity (vulnerable system): None
Availability (vulnerable system): None
Confidentiality (subsequent systems): None
Integrity (subsequent systems): None
Availability (subsequent systems): None
Exploit maturity: Proof of concept

CVSS 3.1 4.3

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Attack vector: Network
Attack complexity: Low
Privileges required: Low
User interaction: None
Scope: Unchanged
Confidentiality: Low
Integrity: None
Availability: None

Weakness

CWE-266: Incorrect Privilege Assignment

A product incorrectly assigns a privilege to a particular actor, creating an unintended sphere of control for that actor.

How to prevent it

Architecture and Design, Operation: Very carefully manage the setting, management, and handling of privileges. Explicitly manage trust zones in the software.
Architecture and Design, Operation: Run your code using the lowest privileges that are required to accomplish the necessary tasks [REF-76]. If possible, create isolated accounts with limited privileges that are only used for a single task. That way, a successful attack will not immediately give the attacker access to the rest of the software or its environment. For example, database applications rarely need to run as the database administrator, especially in day-to-day operations.

References

Advisories

nvd.nist.gov/vuln/detail/CVE-2026-10215

Packages

github.com/Dolibarr/dolibarr

Timeline

Jun 1, 2026 Published
Sep 10, 2026 Last updated by the source
Nov 1, 2026 Latest EPSS score

Advisory	Severity	Why it's related
GHSA-v5fq-cf5m-vwv7 Dolibarr has SQL Injection in societe/class/societe.class.php via localtax1_value parameter	High	Also affects dolibarr/dolibarr
GHSA-hxmh-2xc4-c894 Dolibarr ERP CRM contains a remote code evaluation vulnerability	Critical	Also affects dolibarr/dolibarr
GHSA-jggh-5rmh-r6h5 Dolibarr has Insufficient Verification of Data Authenticity	Low	Also affects dolibarr/dolibarr
GHSA-rvwr-q5hj-wq7g Dolibarr has an Injection issue	Medium	Also affects dolibarr/dolibarr
GHSA-j2g9-rprv-hrhc Dolibarr user with permission to edit PHP content can bypass filtering to restrict dangerous PHP functions	High	Also affects dolibarr/dolibarr
GHSA-676v-wh57-p375 Dolibarr Allows Code Injection through its Website Module	High	Also affects dolibarr/dolibarr
GHSA-w5j3-8fcr-h87w Dolibarr: OS Command Injection (RCE) via MAIN_ODT_AS_PDF configuration	Critical	Also affects dolibarr/dolibarr
GHSA-xxxg-x793-7fq3 Dolibarr has SQL injection vulnerability in the rowid parameter of the admin dict.php	Critical	Also affects dolibarr/dolibarr

Is this in your code?

MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.

Check your repos with MergeHarbor