Live › vulnerability › CVE-2026-116218
Go to dashboardDolibarr ERP CRM versions 19.0.0 up to 23.0.4 fail to escape the type field of the third-party bank accounts REST endpoint. An authenticated API user with only the societe/creer permission can inject SQL to read password hashes and API keys using time-based blind queries.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-26 14:30 UTC. All times on this page are UTC.
Self-hosted Dolibarr installations in the 19.0.0 to 23.0.4 range that have the REST API enabled and have users or API keys with the societe/creer permission. Installations without the REST API exposed, or where API users lack that permission, are not exposed to this path.
No product ranges from the sources yet.
version constant of the installed source, and see whether it is 19.0.0 or later but before 23.0.4.23.0.4 or later.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Dolibarr ERP CRM 19.0.0 before 23.0.4 contains an SQL injection vulnerability that allows authenticated API users to inject SQL via the type field of the third-party bankaccounts REST endpoint. Attackers with only societe/creer permission can break out of the unescaped type value in CompanyBankAccount::create() to read password hashes and API keys via time-based blind subqueries.
This page as .md · .json · in your agent: get_signal("CVE-2026-116218")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.