| タイトル | Dolibarr -server 21.0/22.0 BROKEN ACCESS CONTROL (STILL UNPATCHED) in File Manager Endpoint |
|---|
| 説明 | A broken access control vulnerability affecting the legacy FCKeditor file manager endpoint remains unpatched in the current develop branch. A previous vendor response indicated the issue was fixed in commit 7408306ea9a86abb0e8dd944d79adcdf6059376 however that commit only corrects cosmetic typos (a copyright year and a comment spelling error) and makes no change to the authorization logic. The vulnerability is fully reproducible on the latest code.
AFFECTED FILE
htdocs/core/filemanagerdol/connectors/php/config.inc.php
htdocs/core/filemanagerdol/browser/default/browser.php
Affected endpoint:
/dolibarr/htdocs/core/filemanagerdol/browser/default/browser.php?Connector=/dolibarr/htdocs/core/filemanagerdol/connectors/php/connector.php
WHY THE PREVIOUS FIX IS INVALID
Commit 3740830 (3740830) was cited as the fix. A review of that commit's diff shows it changed exactly two things:
Line 5: copyright year 2024 → 2024-2026
Line 53: comment typo iles → files
The authorization condition was not modified in any way. The broken logic remains identical to what was reported originally.
ROOT CAUSE
The current authorization check in config.inc.php reads:
phpif (!empty($user->admin) && !$user->hasRight('website', 'write')) {
accessforbidden('Need to be admin or having write permission on website module');
exit;
}
This condition is logically inverted. It only triggers when both of the following are true simultaneously:
The user IS an administrator
The user does NOT have website write permission
full rapport vulnerability that dolibarr of team has acknowledge and fix it https://github.com/Dolibarr/dolibarr/issues/38963
fix commit and they credit name abderrahmane aksoum on it as an acknowledge of vulnerability
https://github.com/Dolibarr/dolibarr/commit/ef6631e9bd5ec4b8cec0e88f1796d3d10dad02ec |
|---|
| ソース | ⚠️ https://github.com/Dolibarr/dolibarr/issues/38963 |
|---|
| ユーザー | Abderrahmane Aksoum (UID 97571) |
|---|
| 送信 | 2026年07月18日 11:39 (2 月 ago) |
|---|
| モデレーション | 2026年09月03日 20:25 (2 months later) |
|---|
| ステータス | 承諾済み |
|---|
| VulDBエントリ | 398543 [Dolibarr 迄 21.0.4/22.0.5/23.0.3 Legacy File Manager config.inc.php 特権昇格] |
|---|
| ポイント | 20 |
|---|