CVE-2026-116218 Details
Description
Dolibarr ERP CRM 19.0.0 before 23.0.4 contains an SQL injection vulnerability that allows authenticated API users to inject SQL via the type field of the third-party bankaccounts REST endpoint. Attackers with only societe/creer permission can break out of the unescaped type value in CompanyBankAccount::create() to read password hashes and API keys via time-based blind subqueries.
A SQL injection vulnerability has been identified in Dolibarr ERP CRM versions 19.0.0 prior to 23.0.4. This vulnerability allows authenticated API users to inject SQL through the 'type' field of the 'bankaccounts' REST endpoint. Attackers with 'societe/creer' permission can exploit this issue by manipulating the unescaped 'type' value in the 'CompanyBankAccount::create()' method. The exploitation can lead to the extraction of password hashes and API keys using time-based blind subqueries.
Users can upgrade to Dolibarr ERP CRM version 23.0.4 or later, where this vulnerability has been patched.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 26, 2026CISA-ADP
Assessed Nov 5, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-89 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Dolibarr | >= 19.0.0, < 23.0.4 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Nov 5, 2026 | CVE Modified | CISA-ADP |
| Oct 26, 2026 | New CVE Received | [email protected] |