CVE-2026-10154

Dolibarr ERP CRM messaging.php authorization

State: Published
Severity: 5.3 Medium
Published: May 30, 2026
Updated: Jun 1, 2026
Reserved: May 30, 2026

Description

A vulnerability has been found in Dolibarr ERP CRM 23.0.0/23.0.1/23.0.2. The affected element is an unknown function of the file htdocs/user/messaging.php. Such manipulation of the argument ID leads to authorization bypass. The attack can be executed remotely. Upgrading to version 23.0.3 is sufficient to fix this issue. The name of the patch is 119b3606c7a701747a57a1f18b1a9e7666f678e2. It is suggested to upgrade the affected component.

Scores

CVSS	Score	Vector	Source
4.0	5.3 Medium	CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X	VulDB
3.1	4.3 Medium	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N/E:X/RL:O/RC:C	VulDB
3.0	4.3 Medium	CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N/E:X/RL:O/RC:C	VulDB
2.0	4.0 Medium	AV:N/AC:L/Au:S/C:P/I:N/A:N/E:ND/RL:OF/RC:C	VulDB

Weaknesses

CWE-639 Authorization Bypass
CWE-285 Improper Authorization

Affected Products

Product	Versions
ERP CRMDolibarr	23.0.0Affected 23.0.1Affected 23.0.2Affected 23.0.3Not affected

References

VDB-367407 | Dolibarr ERP CRM messaging.php authorizationvdb-entrytechnical-description
VDB-367407 | CTI Indicators (IOB, IOC, IOA)signaturepermissions-required
Submit #818838 | Dolibarr ERP CRM 23.0.0 23.0.1 23.0.2 Trusting HTTP Permission Methods on the Server Sidethird-party-advisory
https://github.com/dolibarr/dolibarr/commit/119b3606c7a701747a57a1f18b1a9e7666f678e2patch
https://github.com/Dolibarr/dolibarr/releases/tag/23.0.3patch

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.