Vulnerability · Published Oct 19, 2026 · Assigned by VulDB

CVE-2026-112361Dolibarr CSP document.php protection mechanism

Medium 6.3

In plain English

A medium-severity security flaw in Dolibarr. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 30% of all known vulnerabilities).

Severity (CVSS 3.1)6.3Medium

Exploit odds (30 days)0.4%top 70.1% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

A vulnerability has been found in Dolibarr up to 23.0.2. The impacted element is an unknown function of the file htdocs/document.php of the component CSP. Such manipulation leads to protection mechanism failure. The attack can be executed remotely. Upgrading to version 24.0.0 is sufficient to resolve this issue. The name of the patch is 9f9ffa288d4ad2632c1d5dd88272c699a592f4ec. You should upgrade the affected component.

Affected products (as reported)

Vendor	Product	Versions
n/a	Dolibarr	23.0.023.0.123.0.2

Weakness: CWE-693 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:X/RL:O/RC:C

References

VDB-422397 | Dolibarr CSP document.php protection mechanism vdb-entry
VDB-422397 | CTI Indicators (IOB, IOC, IOA) signature, permissions-required
CVE-2026-112361 | CVE Analysis and Report third-party-advisory
Submit #990315 | Dolibarr Dolibarr ERP CRM Latest develop branch as of the submission date, confirmed on official Docker image (v23.0.2) Content-Type Override and API Authorization Bypass Leading to Un third-party-advisory
https://github.com/Dolibarr/dolibarr/commit/9f9ffa288d4ad2632c1d5dd88272c699a592f4ec patch
https://github.com/Dolibarr/dolibarr/releases/tag/24.0.0 patch
https://github.com/Dolibarr/dolibarr/ product