Vulnerability GHSA-7fg5-vc77-69fp
Medium Risk
MEDIUM RISK
CVSS Score: 4.3
Score Range: 4.0–6.9
Medium severity vulnerabilities (CVSS 4.0–6.9). Important issues that meaningfully reduce security confidence.
5 months ago
June 01, 2026 at 03:30 AM UTC
Dolibarr ERP CRM is vulnerable to Improper Authorization through its Leave Request REST API
3.6.0-beta and 3.6.0 - 3.8.0-beta and 3.8.0 - 3.9.0-rc and 3.9.0-rc2 and 3.9.0 - 4.0.0-beta and 4.0.0-rc and 4.0.0-rc2 and 4.0.0 - 5.0.0-beta and 5.0.0-rc1 and 5.0.0-rc2 and 5.0.0 - 6.0.0-beta and 6.0.0-rc and 6.0.0 - 15.0.3
3.6.0-beta and 3.6.0 - 3.8.0-beta and 3.8.0 - 3.9.0-rc and 3.9.0-rc2 and 3.9.0 - 4.0.0-beta and 4.0.0-rc and 4.0.0-rc2 and 4.0.0 - 5.0.0-beta and 5.0.0-rc1 and 5.0.0-rc2 and 5.0.0 - 6.0.0-beta and 6.0.0-rc and 6.0.0 - 15.0.3
Summary
Dolibarr ERP CRM is vulnerable to Improper Authorization through its Leave Request REST API
Details
A security vulnerability has been detected in Dolibarr ERP CRM up to 23.0.1. Impacted is the function checkUserAccessToObject of the file htdocs/holiday/class/api_holidays.class.php of the component Leave Request REST API. The manipulation leads to improper authorization. The attack may be initiated remotely. The exploit has been disclosed publicly and may be used. Upgrading to version 23.0.2 is recommended to address this issue. The identifier of the patch is ee93b6f2f9dd0f6aeefe9d718ab3ab0a44326b73. Upgrading the affected component is advised.
Related Vulnerabilities
Other vulnerabilities affecting the same packages
High Risk
9 days ago
Dolibarr has SQL Injection in societe/class/societe.class.php via localtax1_value parameter
3.6.0-beta and 3.6.0 - 3.8.0-beta and 3.8.0 - 3.9.0-rc and 3.9.0-rc2 and 3.9.0 - 4.0.0-beta and 4.0.0-rc and 4.0.0-rc2 and 4.0.0 - 5.0.0-beta and 5.0.0-rc1 and 5.0.0-rc2 and 5.0.0 - 6.0.0-beta and 6.0.0-rc and 6.0.0 - 15.0.3 GHSA-v5fq-cf5m-vwv7
3.6.0-beta and 3.6.0 - 3.8.0-beta and 3.8.0 - 3.9.0-rc and 3.9.0-rc2 and 3.9.0 - 4.0.0-beta and 4.0.0-rc and 4.0.0-rc2 and 4.0.0 - 5.0.0-beta and 5.0.0-rc1 and 5.0.0-rc2 and 5.0.0 - 6.0.0-beta and 6.0.0-rc and 6.0.0 - 15.0.3 GHSA-v5fq-cf5m-vwv7
Critical
5 months ago
Dolibarr ERP CRM contains a remote code evaluation vulnerability
3.6.0-beta and 3.6.0 - 3.8.0-beta and 3.8.0 - 3.9.0-rc and 3.9.0-rc2 and 3.9.0 - 4.0.0-beta and 4.0.0-rc and 4.0.0-rc2 and 4.0.0 - 5.0.0-beta and 5.0.0-rc1 and 5.0.0-rc2 and 5.0.0 - 6.0.0-beta and 6.0.0-rc and 6.0.0 - 7.0.3 GHSA-hxmh-2xc4-c894
3.6.0-beta and 3.6.0 - 3.8.0-beta and 3.8.0 - 3.9.0-rc and 3.9.0-rc2 and 3.9.0 - 4.0.0-beta and 4.0.0-rc and 4.0.0-rc2 and 4.0.0 - 5.0.0-beta and 5.0.0-rc1 and 5.0.0-rc2 and 5.0.0 - 6.0.0-beta and 6.0.0-rc and 6.0.0 - 7.0.3 GHSA-hxmh-2xc4-c894
Low Risk
6 months ago
Dolibarr has Insufficient Verification of Data Authenticity
3.6.0-beta and 3.6.0 - 3.8.0-beta and 3.8.0 - 3.9.0-rc and 3.9.0-rc2 and 3.9.0 - 4.0.0-beta and 4.0.0-rc and 4.0.0-rc2 and 4.0.0 - 5.0.0-beta and 5.0.0-rc1 and 5.0.0-rc2 and 5.0.0 - 6.0.0-beta and 6.0.0-rc and 6.0.0 - 15.0.3 GHSA-jggh-5rmh-r6h5
3.6.0-beta and 3.6.0 - 3.8.0-beta and 3.8.0 - 3.9.0-rc and 3.9.0-rc2 and 3.9.0 - 4.0.0-beta and 4.0.0-rc and 4.0.0-rc2 and 4.0.0 - 5.0.0-beta and 5.0.0-rc1 and 5.0.0-rc2 and 5.0.0 - 6.0.0-beta and 6.0.0-rc and 6.0.0 - 15.0.3 GHSA-jggh-5rmh-r6h5
Medium Risk
6 months ago
Dolibarr has an Injection issue
3.6.0-beta and 3.6.0 - 3.8.0-beta and 3.8.0 - 3.9.0-rc and 3.9.0-rc2 and 3.9.0 - 4.0.0-beta and 4.0.0-rc and 4.0.0-rc2 and 4.0.0 - 5.0.0-beta and 5.0.0-rc1 and 5.0.0-rc2 and 5.0.0 - 6.0.0-beta and 6.0.0-rc and 6.0.0 - 15.0.3 GHSA-rvwr-q5hj-wq7g
3.6.0-beta and 3.6.0 - 3.8.0-beta and 3.8.0 - 3.9.0-rc and 3.9.0-rc2 and 3.9.0 - 4.0.0-beta and 4.0.0-rc and 4.0.0-rc2 and 4.0.0 - 5.0.0-beta and 5.0.0-rc1 and 5.0.0-rc2 and 5.0.0 - 6.0.0-beta and 6.0.0-rc and 6.0.0 - 15.0.3 GHSA-rvwr-q5hj-wq7g
High Risk
6 months ago
Dolibarr Allows Code Injection through its Website Module
3.6.0-beta and 3.6.0 - 3.8.0-beta and 3.8.0 - 3.9.0-rc and 3.9.0-rc2 and 3.9.0 - 4.0.0-beta and 4.0.0-rc and 4.0.0-rc2 and 4.0.0 - 5.0.0-beta and 5.0.0-rc1 and 5.0.0-rc2 and 5.0.0 - 6.0.0-beta and 6.0.0-rc and 6.0.0 - 15.0.3 GHSA-676v-wh57-p375
3.6.0-beta and 3.6.0 - 3.8.0-beta and 3.8.0 - 3.9.0-rc and 3.9.0-rc2 and 3.9.0 - 4.0.0-beta and 4.0.0-rc and 4.0.0-rc2 and 4.0.0 - 5.0.0-beta and 5.0.0-rc1 and 5.0.0-rc2 and 5.0.0 - 6.0.0-beta and 6.0.0-rc and 6.0.0 - 15.0.3 GHSA-676v-wh57-p375
Impacted packages
Timeline
Published
5 months ago
June 01, 2026 at 03:30 AM UTC
Last Modified
1 month ago
September 10, 2026 at 03:50 AM UTC