What’s Vulnerable › Products

dolibarr vulnerabilities

131 known vulnerabilities, 0 confirmed exploited in the wild (CISA KEV), 37 published in the last 12 months.

Check whether your dolibarr version is affected

Latest dolibarr vulnerabilities

• CVE-2026-118754 — Dolibarr ERP CRM before 24.0.2 Missing Authorization via public recruitment view.php (CVSS 5.3)
• CVE-2026-116218 — Dolibarr ERP CRM 19.0.0 before 23.0.4 SQL Injection via bankaccounts API type field (CVSS 7.6)
• CVE-2026-110874 — Dolibarr before 23.0.4 PHP Object Injection via jsonOrUnserialize() (CVSS 6.6)
• CVE-2026-107706 — Dolibarr before 24.0.2 Incorrect Authorization via updateextrafield.php (CVSS 4.3)
• CVE-2026-89013 — Dolibarr 23.0.4 < 24.0.1 Authorization Bypass via hashp Parameter in document.php (CVSS 7.5)
• CVE-2026-89012 — Dolibarr 24.0.0 < 24.0.1 SQL Filter Denylist Bypass via sqlfilters Parameter (CVSS 6.5)
• CVE-2026-82633 — Dolibarr 10.0.0 before 24.0.0 Missing Authorization on REST Users Groups Endpoint (CVSS 4.3)
• CVE-2026-81730 — Dolibarr 9.0.0 through 23.0.4 Path Traversal via EmailCollector Attachment Filename (CVSS 8.2)
• CVE-2026-81729 — Dolibarr before 23.0.4 Incorrect Authorization on REST API Document Deletion (CVSS 6.5)
• CVE-2026-81728 — Dolibarr before 24.0.0 SQL Injection via the CSV and XLSX Import Update Keys (CVSS 8.1)
• CVE-2026-77923 — Dolibarr 21.0.0 < 24.0.0 Authorization Bypass via clonetasks Mass Action (CVSS 4.3)
• CVE-2026-71511 — Dolibarr < 24.0.0 Members REST API Sensitive Data Exposure via Member Endpoints (CVSS 6.5)
• CVE-2026-71510 — Dolibarr < 24.0.0 Users REST API SQL Injection via filter parameter (CVSS 6.5)
• CVE-2026-71509 — Dolibarr < 24.0.0 Expense Report REST API Improper Authorization via Update Endpoint (CVSS 6.5)
• CVE-2026-71508 — Dolibarr < 24.0.0 REST API Improper Authorization via User Update Endpoint (CVSS 6.5)
• CVE-2026-71507 — Dolibarr < 24.0.0 REST API Broken Object-Level Authorization via Bank Account Routes (CVSS 6.5)
• CVE-2026-71506 — Dolibarr < 24.0.0 Payments REST API Improper Authorization via Delete Endpoint (CVSS 8.1)
• CVE-2026-71505 — Dolibarr < 24.0.0 REST API Broken Object-Level Authorization via Third-Party Write Route (CVSS 7.1)
• CVE-2026-71504 — Dolibarr < 24.0.0 Members REST API Improper Authorization via Password Reset (CVSS 8.1)
• CVE-2026-71503 — Dolibarr < 24.0.0 Reflected XSS via Extra Fields Administration Template (CVSS 6.1)
• CVE-2026-58376 — Dolibarr - SQL Injection via sqlfilters Parameter in Multiple REST API List Endpoints (CVSS 7.6)
• CVE-2018-25357 — Dolibarr ERP CRM 7.0.3 Remote Code Execution via install/step1.php (CVSS 9.8)
• CVE-2025-67486 — Dolibarr has an Authenticated Remote Code Execution via eval() injection in user extrafields (CVSS 7.2)
• CVE-2026-31019 — (CVSS 8.8)
• CVE-2026-31018 — (CVSS 8.8)