{"id":"CVE-2026-116218","kind":"vulnerability","aliases":["CVE-2026-116218"],"related":[],"title":"Dolibarr ERP CRM: SQL injection via bank account API lets users read credentials","description":"Dolibarr ERP CRM 19.0.0 before 23.0.4 contains an SQL injection vulnerability that allows authenticated API users to inject SQL via the type field of the third-party bankaccounts REST endpoint. Attackers with only societe/creer permission can break out of the unescaped type value in CompanyBankAccount::create() to read password hashes and API keys via time-based blind subqueries.","summary":"Dolibarr ERP CRM versions 19.0.0 up to 23.0.4 fail to escape the type field of the third-party bank accounts REST endpoint. An authenticated API user with only the societe/creer permission can inject SQL to read password hashes and API keys using time-based blind queries.","severity":"high","cvss":7.6,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["dolibarr","package","rest-api","self-hosted"],"not_affected_if":["api-disabled","no-societe-creer-users","version-23.0.4-or-later"],"how_to_check":"- Check the installed Dolibarr version in the application's About page or in the `version` constant of the installed source, and see whether it is 19.0.0 or later but before `23.0.4`.\n- Check whether API access is enabled and whether any API users hold the societe/creer permission.","fix":"- Upgrade Dolibarr to `23.0.4` or later.\n- Until then, restrict REST API access to trusted users and revoke the societe/creer permission from API users who do not need it.","status":"open","published_at":"2026-10-26T14:16:34+00:00","first_seen_at":"2026-10-26T14:30:36+00:00","triaged_at":"2026-10-26T14:32:21+00:00","updated_at":"2026-10-26T14:32:21+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-10-26T14:32:21Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade Dolibarr to `23.0.4` or later.\n- Until then, restrict REST API access to trusted users and revoke the societe/creer permission from API users who do not need it.","reach":"internet","title":"Dolibarr ERP CRM: SQL injection via bank account API lets users read credentials","impact":"high","summary":"Dolibarr ERP CRM versions 19.0.0 up to 23.0.4 fail to escape the type field of the third-party bank accounts REST endpoint. An authenticated API user with only the societe/creer permission can inject SQL to read password hashes and API keys using time-based blind queries.","category":"package","nicknames":[],"who_cares":["dolibarr","self-hosted","rest-api"],"confidence":0.7,"needs_auth":"yes","worst_case":"Attacker reads password hashes and API keys from the database.","analyst_note":"Confirm the affected version range and fixed release against the NVD entry and the Dolibarr release notes; sources give only the NVD record.","how_to_check":"- Check the installed Dolibarr version in the application's About page or in the `version` constant of the installed source, and see whether it is 19.0.0 or later but before `23.0.4`.\n- Check whether API access is enabled and whether any API users hold the societe/creer permission.","needs_analyst":true,"not_affected_if":["api-disabled","no-societe-creer-users","version-23.0.4-or-later"],"who_is_affected":"Self-hosted Dolibarr installations in the 19.0.0 to 23.0.4 range that have the REST API enabled and have users or API keys with the societe/creer permission. Installations without the REST API exposed, or where API users lack that permission, are not exposed to this path.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"high"},"cost_usd":0.000651,"input_tokens":3365,"output_tokens":629,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-116218':16A,19A '-2026':15A,18A '19.0.0':32B,79C '23.0.4':35B,81C 'account':8A,48B 'allow':88C 'api':9A,24B,53B,68B,90C,128C 'attack':107C 'authent':52B,89C 'bank':7A,47B 'bankaccount':104C 'base':73B,133C 'blind':74B,134C 'break':113C 'companybankaccount':121C 'contain':82C 'creat':122C 'credenti':13A 'crm':3A,30B,78C 'cve':14A,17A 'dolibarr':1A,20B,28B,76C 'endpoint':50B,106C 'erp':2A,29B,77C 'escap':38B 'fail':36B 'field':41B,98C 'hash':66B,126C 'host':27B 'inject':5A,61B,85C,93C 'key':69B,129C 'let':10A 'packag':21B 'parti':46B,103C 'password':65B,125C 'permiss':59B,111C 'queri':75B 'read':12A,64B,124C 'rest':23B,49B,105C 'rest-api':22B 'self':26B 'self-host':25B 'societe/creer':58B,110C 'sql':4A,62B,84C,94C 'subqueri':135C 'third':45B,102C 'third-parti':44B,101C 'time':72B,132C 'time-bas':71B,131C 'type':40B,97C,118C 'unescap':117C 'use':70B 'user':11A,54B,91C 'valu':119C 'version':31B 'via':6A,95C,130C 'vulner':86C","nicknames":[],"mitigations":[],"who_affected":"Self-hosted Dolibarr installations in the 19.0.0 to 23.0.4 range that have the REST API enabled and have users or API keys with the societe/creer permission. Installations without the REST API exposed, or where API users lack that permission, are not exposed to this path.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-26T14:16:34+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-116218","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-116218","severity":null,"published_at":"2026-10-26T14:16:34+00:00","modified_at":"2026-10-26T14:16:34+00:00","first_seen_at":"2026-10-26T14:30:36+00:00","fetched_at":"2026-10-26T14:30:36+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}