CVE-2026-11619

Dolibarr ERP CRM Legacy Filemanager config.inc.php improper authorization

State: Published
Severity: 5.3 Medium
Published: Jun 9, 2026
Updated: Jun 9, 2026
Reserved: Jun 8, 2026

Description

A vulnerability was identified in Dolibarr ERP CRM up to 23.0.2. The impacted element is an unknown function of the file htdocs/core/filemanagerdol/connectors/php/config.inc.php of the component Legacy Filemanager. The manipulation leads to improper authorization. It is possible to initiate the attack remotely. The exploit is publicly available and might be used. Upgrading to version 23.0.3 is sufficient to resolve this issue. The identifier of the patch is f1b2dd6481e22cacb561d29ffdcd3a50b618479d. Upgrading the affected component is advised.

Scores

CVSS	Score	Vector	Source
4.0	5.3 Medium	CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P	VulDB
3.1	6.3 Medium	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C	VulDB
3.0	6.3 Medium	CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C	VulDB
2.0	6.5 Medium	AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:OF/RC:C	VulDB

Weaknesses

CWE-285 Improper Authorization
CWE-266 Incorrect Privilege Assignment

Affected Products

Product	Versions
ERP CRMDolibarr	23.0.0Affected 23.0.1Affected 23.0.2Affected 23.0.3Not affected

References

VDB-369300 | Dolibarr ERP CRM Legacy Filemanager config.inc.php improper authorizationvdb-entry
VDB-369300 | CTI Indicators (IOB, IOC, TTP, IOA)signaturepermissions-required
CVE-2026-11619 | CVE Analysis and Reportthird-party-advisory
Submit #834038 | Dolibarr Dolibarr ERP/CRM up to 23.0.3 Missing Authorizationthird-party-advisory
https://github.com/dolibarr/dolibarr/commit/f1b2dd6481e22cacb561d29ffdcd3a50b618479dpatch
https://github.com/Dolibarr/dolibarr/releases/tag/23.0.3patch

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.