| Título | Dolibarr -server 21.0/22.0 BROKEN ACCESS CONTROL (STILL UNPATCHED) in File Manager Endpoint |
|---|
| Descripción | A broken access control vulnerability affecting the legacy FCKeditor file manager endpoint remains unpatched in the current develop branch. A previous vendor response indicated the issue was fixed in commit 7408306ea9a86abb0e8dd944d79adcdf6059376 however that commit only corrects cosmetic typos (a copyright year and a comment spelling error) and makes no change to the authorization logic. The vulnerability is fully reproducible on the latest code.
AFFECTED FILE
htdocs/core/filemanagerdol/connectors/php/config.inc.php
htdocs/core/filemanagerdol/browser/default/browser.php
Affected endpoint:
/dolibarr/htdocs/core/filemanagerdol/browser/default/browser.php?Connector=/dolibarr/htdocs/core/filemanagerdol/connectors/php/connector.php
WHY THE PREVIOUS FIX IS INVALID
Commit 3740830 (3740830) was cited as the fix. A review of that commit's diff shows it changed exactly two things:
Line 5: copyright year 2024 → 2024-2026
Line 53: comment typo iles → files
The authorization condition was not modified in any way. The broken logic remains identical to what was reported originally.
ROOT CAUSE
The current authorization check in config.inc.php reads:
phpif (!empty($user->admin) && !$user->hasRight('website', 'write')) {
accessforbidden('Need to be admin or having write permission on website module');
exit;
}
This condition is logically inverted. It only triggers when both of the following are true simultaneously:
The user IS an administrator
The user does NOT have website write permission
full rapport vulnerability that dolibarr of team has acknowledge and fix it https://github.com/Dolibarr/dolibarr/issues/38963
fix commit and they credit name abderrahmane aksoum on it as an acknowledge of vulnerability
https://github.com/Dolibarr/dolibarr/commit/ef6631e9bd5ec4b8cec0e88f1796d3d10dad02ec |
|---|
| Fuente | ⚠️ https://github.com/Dolibarr/dolibarr/issues/38963 |
|---|
| Usuario | Abderrahmane Aksoum (UID 97571) |
|---|
| Sumisión | 2026-07-18 11:39 (hace 2 meses) |
|---|
| Moderación | 2026-09-03 20:25 (2 months later) |
|---|
| Estado | Aceptado |
|---|
| Entrada de VulDB | 398543 [Dolibarr hasta 21.0.4/22.0.5/23.0.3 Legacy File Manager config.inc.php escalada de privilegios] |
|---|
| Puntos | 20 |
|---|