PT-2026-7852 · Unknown · Dolibarr Erp/Crm

Published 2026-02-12 · Updated 2026-02-14 · CVE-2025-69634

Positive Technologies (AI Summary)

CVSS v3.1

9.0

Critical

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Dolibarr ERP & CRM version 22.0.9

Description A Cross Site Request Forgery issue exists in Dolibarr ERP & CRM version 22.0.9. A remote attacker may be able to escalate privileges through the notes field in the perms.php file. It is noted that exploitation may only be possible if an unprivileged user has access to an administrator's token. The API endpoint involved is perms.php. The vulnerable parameter is notes.

Recommendations Versions prior to 22.0.9 are affected. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

LPE

CSRF

Improper Access Control

Weakness Enumeration

CWE-352

CWE-598

CWE-284

Related Identifiers

CVE-2025-69634

Affected Products

Dolibarr Erp/Crm

References · 11

• 🔥 https://github.com/simone97212/vuln-research/tree/main/CVE-2025-69634 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2025-69634 · Security Note
• https://ubuntu.com/security/CVE-2025-69634 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2025-69634 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2025-69634 · Security Note
• https://github.com/simone97212/DolibarrVuln · Note
• https://t.me/cveNotify/152017 · Telegram Post
• https://twitter.com/CveFindCom/status/2022025719455375775 · Twitter Post
• https://t.me/CVEtracker/44537 · Telegram Post
• https://twitter.com/VulmonFeeds/status/2022002707557433636 · Twitter Post
• https://twitter.com/TheHackerWire/status/2021982008461938723 · Twitter Post