High severity · published Oct 26, 2026
CVE-2026-116218
Dolibarr ERP CRM 19.0.0 before 23.0.4 SQL Injection via bankaccounts API type field
New
7.6
CVSS
0.3%
EPSS
No
On KEV
Description
Dolibarr ERP CRM 19.0.0 before 23.0.4 contains an SQL injection vulnerability that allows authenticated API users to inject SQL via the type field of the third-party bankaccounts REST endpoint. Attackers with only societe/creer permission can break out of the unescaped type value in CompanyBankAccount::create() to read password hashes and API keys via time-based blind subqueries.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
Low
Availability
Low
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 19% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
DO
dolibarr · Dolibarr
19.0.0 before 23.0.4 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-116218
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-116218
github.com
https://github.com/Dolibarr/dolibarr
github.com
https://github.com/Dolibarr/dolibarr/blob/23.0.3/htdocs/societe/class/api_thirdparties.class.php#L1852
github.com
https://github.com/Dolibarr/dolibarr/blob/23.0.3/htdocs/societe/class/companybankaccount.class.php#L399
github.com
https://github.com/Dolibarr/dolibarr/commit/19991c8ffa9b4fd7338b7ef2585fadb554b86735
www.vulncheck.com
https://www.vulncheck.com/advisories/dolibarr-erp-crm-19.0.0-before-23.0.4-sql-injection-via-bankaccounts-api-type-field
More from dolibarr
9.8
CVE-2019-19212
Dolibarr ERP/CRM 3.0 through 10.0.3 allows XSS via the qty parameter to product/fournisseurs.php (product price screen)
9.8
CVE-2018-16809
An issue was discovered in Dolibarr through 7.0.0
9.8
CVE-2018-9019
SQL Injection vulnerability in Dolibarr before version 7.0.2 allows remote attackers to execute arbitrary SQL commands via the sortfield parameter to…
9.8
CVE-2018-10094
SQL injection vulnerability in Dolibarr before 7.0.2 allows remote attackers to execute arbitrary SQL commands via vectors involving integer parameters without quotes
9.8
CVE-2017-14242
SQL injection vulnerability in don/list.php in Dolibarr version 6.0.0 allows remote attackers to execute arbitrary SQL commands via the statut parameter