CVE-2026-107706 — Dolibarr before 24.0.2 Incorrect Authorization via updateextrafield.php
Dolibarr ERP CRM before 24.0.2 contains an incorrect authorization vulnerability in htdocs/core/ajax/updateextrafield.php that checks only read permission before writing extrafi…
Published: 2026-10-08 · CVSS: 5.3 · CVSS 4.0
Dolibarr ERP CRM before 24.0.2 contains an incorrect authorization vulnerability in htdocs/core/ajax/updateextrafield.php that checks only read permission before writing extrafield values. Authenticated users with read-only access can POST objectType, objectId, field and value parameters to persistently modify extrafields on viewable third parties, products, members, projects or contacts.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7