Vulnerability · Published Oct 26, 2026 · Assigned by VulnCheck

CVE-2026-116218Dolibarr ERP CRM 19.0.0 before 23.0.4 SQL Injection via bankaccounts API type field

High 7.6

In plain English

A high-severity SQL injection in dolibarr from Dolibarr. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 20% of all known vulnerabilities).

Severity (CVSS 3.1)7.6High

Exploit odds (30 days)0.3%top 80.4% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Dolibarr ERP CRM 19.0.0 before 23.0.4 contains an SQL injection vulnerability that allows authenticated API users to inject SQL via the type field of the third-party bankaccounts REST endpoint. Attackers with only societe/creer permission can break out of the unescaped type value in CompanyBankAccount::create() to read password hashes and API keys via time-based blind subqueries.

Affected products (as reported)

Vendor	Product	Versions
Dolibarr	dolibarr	19.0.0 – before 23.0.4

Weakness: CWE-89 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L

References

Patch Commit patch
https://github.com/Dolibarr/dolibarr/blob/23.0.3/htdocs/societe/class/companybankaccount.class.php#L399 technical-description
https://github.com/Dolibarr/dolibarr/blob/23.0.3/htdocs/societe/class/api_thirdparties.class.php#L1852 technical-description
https://github.com/Dolibarr/dolibarr product
VulnCheck Advisory: Dolibarr ERP CRM 19.0.0 before 23.0.4 SQL Injection via bankaccounts API type field third-party-advisory