Medium severity · published Aug 16, 2026
CVE-2026-19930
Dolibarr User Cloning card.php ldap injection
6.3
CVSS
0.4%
EPSS
No
On KEV
Description
A security flaw has been discovered in Dolibarr up to 23.0.3. Affected is an unknown function of the file htdocs/user/card.php of the component User Cloning. The manipulation of the argument ID results in ldap injection. It is possible to launch the attack remotely. The exploit has been released to the public and may be used for attacks. The patch is identified as 798e65356ede03c2812ab1a728f23fae34de5592. It is advisable to implement a patch to correct this issue.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
Low
Integrity
Low
Availability
Low
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.4% · higher than 36% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
DO
Dolibarr · Dolibarr
23.0.0; 23.0.1; 23.0.2; 23.0.3 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-19930
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-19930
drive.google.com
https://drive.google.com/file/d/1tI3kUdqocvdQwQtqOi5zCFmTMm6eA3sF/view
github.com
https://github.com/Dolibarr/dolibarr/
github.com
https://github.com/Dolibarr/dolibarr/commit/798e65356ede03c2812ab1a728f23fae34de5592
github.com
https://github.com/Dolibarr/dolibarr/issues/39000
vuldb.com
https://vuldb.com/cve/CVE-2026-19930
vuldb.com
https://vuldb.com/submit/872355
More from Dolibarr
9.8
CVE-2019-19212
Dolibarr ERP/CRM 3.0 through 10.0.3 allows XSS via the qty parameter to product/fournisseurs.php (product price screen)
9.8
CVE-2018-16809
An issue was discovered in Dolibarr through 7.0.0
9.8
CVE-2018-9019
SQL Injection vulnerability in Dolibarr before version 7.0.2 allows remote attackers to execute arbitrary SQL commands via the sortfield parameter to…
9.8
CVE-2018-10094
SQL injection vulnerability in Dolibarr before 7.0.2 allows remote attackers to execute arbitrary SQL commands via vectors involving integer parameters without quotes
9.8
CVE-2017-14242
SQL injection vulnerability in don/list.php in Dolibarr version 6.0.0 allows remote attackers to execute arbitrary SQL commands via the statut parameter