Vulnerability · Published Jun 30, 2026 · Assigned by VulnCheck

CVE-2026-58376Dolibarr - SQL Injection via sqlfilters Parameter in Multiple REST API List Endpoints

High 7.6

In plain English

A high-severity SQL injection in dolibarr from Dolibarr. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 30% of all known vulnerabilities).

Severity (CVSS 3.1)7.6High

Exploit odds (30 days)0.4%top 70.2% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

Dolibarr through 23.0.3, fixed in commit 14db36e, contains a sql injection vulnerability that allows authenticated API users to exfiltrate arbitrary database contents by supplying malicious values to the sqlfilters query parameter in the setup dictionary and multicurrencies REST API endpoints. The affected endpoints in api_setup.class.php and api_multicurrencies.class.php validate sqlfilters only for balanced parentheses and rewrite matched triplets, allowing text placed outside the expected shape such as an appended UNION SELECT to be concatenated into the SQL WHERE clause unmodified, enabling retrieval of sensitive data including password hashes and API keys.

Affected products (as reported)

Vendor	Product	Versions
Dolibarr	dolibarr	0 – through 23.0.3

Weakness: CWE-89 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L

References

Researcher Disclosure exploit, technical-description
Fix PR issue-tracking
Fix Commit patch
https://www.vulncheck.com/advisories/dolibarr-sql-injection-via-sqlfilters-parameter-in-multiple-rest-api-list-endpoints third-party-advisory