CVE-2026-107706
4.3 MEDIUMpublic exploit availablePublished 2026-10-08 · Updated 2026-10-08
AI analysis for this CVE has not been generated yet. Raw NVD data is shown below.
NVD description
Dolibarr ERP CRM before 24.0.2 contains an incorrect authorization vulnerability in htdocs/core/ajax/updateextrafield.php that checks only read permission before writing extrafield values. Authenticated users with read-only access can POST objectType, objectId, field and value parameters to persistently modify extrafields on viewable third parties, products, members, projects or contacts.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
Weaknesses
CWE-863
Public exploit & PoC references
All references
- https://github.com/Dolibarr/dolibarr
- https://github.com/Dolibarr/dolibarr/blob/24.0.1/htdocs/core/ajax/updateextrafield.php#L80
- https://github.com/Dolibarr/dolibarr/commit/3420d17b199059ac22fca8b59f23cb8962fc8ef8
- https://www.vulncheck.com/advisories/dolibarr-before-24.0.2-incorrect-authorization-via-updateextrafield-php
Source data: NVD (nvd.nist.gov), public domain. Exploit-DB.ai adds local AI analysis for defensive use only.
Related CVEs
- HIGHCVE-2024-22031PoC
- MEDIUMCVE-2026-100259
- HIGHCVE-2026-100262
- LOWCVE-2026-100270
- HIGHCVE-2026-100273
- MEDIUMCVE-2026-100276
- HIGHCVE-2026-100277
- MEDIUMCVE-2026-100278
Related by shared AI tags and CWE weakness class. Browse the full archive.