CVE-2026-10215 in ERP CRM
Summary
by MITRE • 06/01/2026
A security vulnerability has been detected in Dolibarr ERP CRM up to 23.0.1. Impacted is the function checkUserAccessToObject of the file htdocs/holiday/class/api_holidays.class.php of the component Leave Request REST API. The manipulation leads to improper authorization. The attack may be initiated remotely. The exploit has been disclosed publicly and may be used. Upgrading to version 23.0.2 is recommended to address this issue. The identifier of the patch is ee93b6f2f9dd0f6aeefe9d718ab3ab0a44326b73. Upgrading the affected component is advised.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 06/07/2026
This vulnerability in Dolibarr ERP CRM represents a critical authorization flaw that undermines the security of the Leave Request REST API component. The issue resides within the checkUserAccessToObject function located in htdocs/holiday/class/api_holidays.class.php, where improper access control mechanisms fail to properly validate user permissions before granting access to leave request data. This vulnerability specifically affects versions up to 23.0.1 and constitutes a direct violation of proper access control principles that should prevent unauthorized users from accessing sensitive employee leave information through the REST API interface.
The technical implementation flaw allows remote attackers to exploit this weakness without requiring authentication or authorization, creating a significant security risk for organizations using Dolibarr's leave management functionality. The vulnerability enables unauthorized access to leave request data, potentially exposing sensitive employee information including vacation time, sick leave records, and other personal leave details. This type of improper authorization vulnerability maps directly to CWE-285, which specifically addresses insufficient authorization issues in software systems. The remote exploitability means that attackers can leverage this weakness from outside the network perimeter without requiring physical access or prior credentials.
The operational impact of this vulnerability extends beyond simple data exposure, as it could enable attackers to manipulate leave records, potentially leading to fraudulent leave requests or unauthorized access to employee time-off data. Organizations relying on Dolibarr for human resources management face significant risks including potential compliance violations under data protection regulations such as GDPR or CCPA, as unauthorized access to employee leave records constitutes sensitive personal data processing. The vulnerability also creates opportunities for privilege escalation attacks where malicious actors might use this weakness as a foothold to access other system components or escalate their access privileges within the Dolibarr environment.
Security practitioners should immediately implement mitigation strategies while planning the mandatory upgrade to version 23.0.2, which contains the fix identified by the patch identifier ee93b6f2f9dd0f6aeefe9d718ab3ab0a44326b73. The remediation process should include comprehensive network monitoring to detect potential exploitation attempts and immediate deployment of the patched version across all affected systems. Organizations should also review their access control policies and implement additional security controls such as API rate limiting and enhanced logging of REST API calls to detect suspicious activities. From an ATT&CK framework perspective, this vulnerability aligns with techniques involving privilege escalation and credential access, potentially enabling adversaries to move laterally within the organization's HR information systems. The public disclosure of the exploit increases the urgency for remediation, as threat actors may already be actively targeting vulnerable installations.