Medium severity · published May 30, 2026
CVE-2026-10154
Dolibarr ERP CRM messaging.php authorization
4.3
CVSS
0.2%
EPSS
No
On KEV
Description
A vulnerability has been found in Dolibarr ERP CRM 23.0.0/23.0.1/23.0.2. The affected element is an unknown function of the file htdocs/user/messaging.php. Such manipulation of the argument ID leads to authorization bypass. The attack can be executed remotely. Upgrading to version 23.0.3 is sufficient to fix this issue. The name of the patch is 119b3606c7a701747a57a1f18b1a9e7666f678e2. It is suggested to upgrade the affected component.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
Low
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.2% · higher than 13% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
EC
ERP CRM · Dolibarr
23.0.0; 23.0.1; 23.0.2 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-10154
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-10154
github.com
https://github.com/Dolibarr/dolibarr/releases/tag/23.0.3
github.com
https://github.com/dolibarr/dolibarr/commit/119b3606c7a701747a57a1f18b1a9e7666f678e2
vuldb.com
https://vuldb.com/submit/818838
vuldb.com
https://vuldb.com/vuln/367407
vuldb.com
https://vuldb.com/vuln/367407/cti
More from ERP CRM
6.3
CVE-2026-11619
Dolibarr ERP CRM Legacy Filemanager config.inc.php improper authorization
5.0
CVE-2026-7688
Dolibarr ERP CRM Shipments API Endpoint expedition.class.php _checkValForAPI sql injection
4.3
CVE-2026-10215
Dolibarr ERP CRM Leave Request REST API api_holidays.class.php checkUserAccessToObject improper authorization
3.7
CVE-2026-7689
Dolibarr ERP CRM Online Signature security.lib.php dol_verifyHash signature verification