Dolibarr third-party update flaw exposes database data
Staff logins to Dolibarr business software can leak company data.
Summary
A logged-in user with permission to create or edit third-party records can read sensitive database data, such as password hashes and API keys, or change third-party records. Dolibarr versions before the fixed releases are affected.
Affected when
- Logged-in user with Third Party create or edit permission
What to do
Update to 22.0.5 or 23.0.2.
Update to at least the version for your product:
- Dolibarr 22.x 22.0.5 or later
- Dolibarr 23.x 23.0.2 or later
Products and platforms
CVE IDs
Sources
- CVE record: cve.org (opens in a new tab)
Times
First published
First seen