PT-2026-45247 · Unknown · Dolibarr Erp/Crm

Mitch311 · Published 2026-06-01 · Updated 2026-06-01 · CVE-2026-10215

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Dolibarr ERP CRM versions prior to 23.0.2

Description Improper authorization exists in the Leave Request REST API component. The issue is located in the checkUserAccessToObject() function within the htdocs/holiday/class/api holidays.class.php file, which allows a remote attacker to bypass authorization controls.

Recommendations Update to version 23.0.2. As a temporary mitigation, restrict access to the Leave Request REST API component.

Exploit

Fix

Incorrect Privilege Assignment

Improper Authorization

Weakness Enumeration

CWE-266

CWE-285

Related Identifiers

CVE-2026-10215

Affected Products

Dolibarr Erp/Crm

References · 13

• 🔥 https://github.com/Dolibarr/dolibarr/issues/37752#issuecomment-4304055921 · Exploit
• 🔥 https://github.com/Dolibarr/dolibarr/issues/37752 · Exploit
• 🔥❌ https://github.com/user-attachments/files/26487388/2_Dolibarr_Leave_Request_API_Horizontal_Unauthorized_Read_en.pdf · Exploit, Deleted
• https://github.com/Dolibarr/dolibarr/releases/tag/23.0.2 · Patch
• https://github.com/Dolibarr/dolibarr/commit/ee93b6f2f9dd0f6aeefe9d718ab3ab0a44326b73 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2026-10215 · Security Note
• https://t.me/cveNotify/165407 · Telegram Post
• https://t.me/CVEtracker/55417 · Telegram Post
• https://vuldb.com/vuln/367494 · Note
• https://vuldb.com/cve/CVE-2026-10215 · Note
• https://vuldb.com/submit/821930 · Note
• https://vuldb.com/vuln/367494/cti · Note
• https://twitter.com/VulmonFeeds/status/2061298810073084012 · Twitter Post