CVE-2026-107706 in Dolibarr
Summary
by MITRE • 10/08/2026
Dolibarr ERP CRM before 24.0.2 contains an incorrect authorization vulnerability in htdocs/core/ajax/updateextrafield.php that checks only read permission before writing extrafield values. Authenticated users with read-only access can POST objectType, objectId, field and value parameters to persistently modify extrafields on viewable third parties, products, members, projects or contacts.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 10/08/2026
The vulnerability identified in Dolibarr ERP CRM prior to version 24.0.2 represents a critical failure in the application's access control logic within its AJAX-based interface for managing custom data fields. Specifically, the flaw resides in the script located at htdocs/core/ajax/updateextrafield.php, which is responsible for updating extra field values associated with various entities such as third parties, products, members, projects, and contacts. The core technical deficiency lies in the sequence of permission checks performed by this endpoint. Instead of verifying that the authenticated user possesses write or edit privileges for the specific entity being modified, the script only validates read permissions. This architectural oversight allows any authenticated user who can view an object to alter its associated extra field data, effectively bypassing intended role-based access controls and elevating their effective privilege level from read-only to full modification capability without requiring elevated credentials.
From a technical perspective, this vulnerability is classified under CWE-269, which denotes Improper Privilege Management. The attacker exploits the logic flaw by sending HTTP POST requests containing specific parameters including objectType, objectId, field, and value. Because the server-side validation relies solely on whether the user can view the target object rather than whether they are authorized to edit it, the system accepts and persists these changes. This behavior violates the principle of least privilege, as users are granted capabilities that exceed their assigned roles. The persistence of this data means that unauthorized modifications remain in the database until manually corrected or overwritten by legitimate administrative actions, potentially leading to long-term integrity issues within the enterprise resource planning environment.
The operational impact of this vulnerability is significant for organizations relying on Dolibarr for sensitive business operations. Since extra fields are often used to store critical metadata such as financial details, legal identifiers, customer preferences, or internal project notes, unauthorized modification can lead to data corruption and misinformation. An attacker with read-only access could alter pricing information in product records, change contact details for third parties, or modify status flags on projects. This not only compromises the integrity of business data but also undermines trust in the system's security posture. In a multi-user environment where different departments have varying levels of access, this flaw allows lower-privileged users to interfere with workflows and decisions made by higher-privileged personnel, potentially causing operational disruptions or financial discrepancies if fraudulent changes are acted upon.
This vulnerability aligns with MITRE ATT&CK technique T1078, Valid Accounts, as it leverages legitimate authentication credentials to perform unauthorized actions. It also reflects aspects of T1530, Data from Information Repositories, although the primary concern here is data modification rather than exfiltration. The ability to persistently modify data without proper authorization checks falls under the broader category of privilege escalation through logical flaws in access control mechanisms. Organizations must recognize that authentication alone does not guarantee authorized action; robust authorization checks are required at every state-changing endpoint within an application.
To mitigate this vulnerability, administrators should immediately upgrade Dolibarr ERP CRM to version 24.0.2 or later, where the issue has been resolved by implementing proper write-permission validation in the updateextrafield.php script. Until upgrading is feasible, organizations can implement compensating controls such as web application firewall rules that restrict access to the affected endpoint based on user roles if possible, although this may not be fully effective due to the nature of AJAX requests. Additionally, enforcing strict role-based access control policies and regularly auditing database changes for anomalies can help detect unauthorized modifications early. It is also recommended to review all custom modules or plugins that interact with extra fields to ensure they do not introduce similar authorization flaws. Regular security assessments focusing on broken access control patterns are essential to maintain the integrity of ERP systems against such logical vulnerabilities.