Vulnerability · Published May 30, 2026 · Assigned by VulDB

CVE-2026-10154Dolibarr ERP CRM messaging.php authorization

Medium 4.3

In plain English

A medium-severity authorization bypass via user-controlled key in ERP CRM from Dolibarr. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 13% of all known vulnerabilities).

Severity (CVSS 3.1)4.3Medium

Exploit odds (30 days)0.2%top 87.0% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

A vulnerability has been found in Dolibarr ERP CRM 23.0.0/23.0.1/23.0.2. The affected element is an unknown function of the file htdocs/user/messaging.php. Such manipulation of the argument ID leads to authorization bypass. The attack can be executed remotely. Upgrading to version 23.0.3 is sufficient to fix this issue. The name of the patch is 119b3606c7a701747a57a1f18b1a9e7666f678e2. It is suggested to upgrade the affected component.

Affected products (as reported)

Vendor	Product	Versions
Dolibarr	ERP CRM	23.0.023.0.123.0.2

Weakness: CWE-639, CWE-285 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N/E:X/RL:O/RC:C

References

VDB-367407 | Dolibarr ERP CRM messaging.php authorization vdb-entry, technical-description
VDB-367407 | CTI Indicators (IOB, IOC, IOA) signature, permissions-required
Submit #818838 | Dolibarr ERP CRM 23.0.0 23.0.1 23.0.2 Trusting HTTP Permission Methods on the Server Side third-party-advisory
https://github.com/dolibarr/dolibarr/commit/119b3606c7a701747a57a1f18b1a9e7666f678e2 patch
https://github.com/Dolibarr/dolibarr/releases/tag/23.0.3 patch