Dolibarr ERP CRM Legacy Filemanager config.inc.php improper authorization

published 2026-06-09 5 mo ago modified 2026-07-23 3 mo ago also EUVD-2026-35294

cvss: 6.3; version 3.1, CNA
cisa kev: Not listed; not in CISA's catalog
epss: 0.2%; EPSS 0.2% chance of exploitation in 30 days, percentile 11%
public exploits: 0; none known

A vulnerability was identified in Dolibarr ERP CRM up to 23.0.2. The impacted element is an unknown function of the file htdocs/core/filemanagerdol/connectors/php/config.inc.php of the component Legacy Filemanager. The manipulation leads to improper authorization. It is possible to initiate the attack remotely. The exploit is publicly available and might be used. Upgrading to version 23.0.3 is sufficient to resolve this issue. The identifier of the patch is f1b2dd6481e22cacb561d29ffdcd3a50b618479d. Upgrading the affected component is advised.

Patch / fix

fixed in 1 links 2

Dolibarr ERP CRM 23.0.3

github.com/dolibarr/dolibarr@f1b2dd6 commit
github.com/Dolibarr/dolibarr/releases/tag/23.0.3 release

CISA SSVC

Exploitation: Proof of concept is public
Automatable: no
Technical impact: partial
Assessed: 5 mo ago (2026-06-09)

Exploit prediction

0.21% chance of exploitation in the next 30 days, higher than 11% of all scored CVEs (FIRST EPSS, 2026-11-08).

Exploits and checks

vuldb.com https://vuldb.com/submit/834038 referenced PoC, tagged "exploit" by a source, unverified

CVSS scores

assigned by	version	score	vector
CNA	4.0	5.3	CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P
CNA	3.1	6.3	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C
CNA	3.0	6.3	CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C
CNA	2.0	6.5	AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:OF/RC:C
CNA	4.0	2.1	CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
CNA	3.1	6.3	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
CNA	2.0	6.5	AV:N/AC:L/Au:S/C:P/I:P/A:P

Affected products

Dolibarr ERP CRM

Classification

Weakness

CWE-285 Improper Authorization
CWE-266 Incorrect Privilege Assignment

References

github.com /dolibarr/dolibarr/commit/f1b2dd6481e22cacb561d29ffdcd3a50b618479d
patch
github.com /Dolibarr/dolibarr/releases/tag/23.0.3
patch
vuldb.com /submit/834038
third-party-advisory, exploit
vuldb.com /vuln/369300
vdb-entry
vuldb.com /vuln/369300/cti
signature, permissions-required
vuldb.com /cve/CVE-2026-11619
third-party-advisory

Sources

CVE List CVE-2026-11619
NVD CVE-2026-11619

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

Summary