CVE-2026-58376 Details
Description
Dolibarr through 23.0.3, fixed in commit 14db36e, contains a sql injection vulnerability that allows authenticated API users to exfiltrate arbitrary database contents by supplying malicious values to the sqlfilters query parameter in the setup dictionary and multicurrencies REST API endpoints. The affected endpoints in api_setup.class.php and api_multicurrencies.class.php validate sqlfilters only for balanced parentheses and rewrite matched triplets, allowing text placed outside the expected shape such as an appended UNION SELECT to be concatenated into the SQL WHERE clause unmodified, enabling retrieval of sensitive data including password hashes and API keys.
A SQL injection vulnerability has been identified in Dolibarr versions through 23.0.3. This vulnerability allows authenticated API users to exfiltrate arbitrary database contents by injecting malicious values into the sqlfilters query parameter. The issue is present in the setup dictionary and multicurrencies REST API endpoints. The vulnerability arises because the affected endpoints only validate sqlfilters for balanced parentheses and improperly sanitize the input, allowing harmful SQL commands to be executed. Exploitation of this vulnerability can lead to the unauthorized retrieval of sensitive data, including password hashes and API keys.
Users can upgrade to Dolibarr version 24.0.0-beta or apply the patch available in the Dolibarr GitHub repository to address this vulnerability.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Jun 30, 2026CISA-ADP
Assessed Jun 30, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/Dolibarr/dolibarr/commit/14db36e8486ef725b0d493d97abb2950a54358d3 | [email protected] | Source CodeVendor |
| https://github.com/Dolibarr/dolibarr/issues/38768 | [email protected] | ExploitIssue TrackingTechnical DescriptionVendor |
| https://github.com/Dolibarr/dolibarr/pull/38794 | [email protected] | Source CodeVendor |
| https://www.vulncheck.com/advisories/dolibarr-sql-injection-via-sqlfilters-parameter-in-multiple-rest-api-list-endpoints | [email protected] | AdvisoryBundleRemedy |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-89 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Dolibarr | <= 23.0.3 (semver) |
CPE
Remediation
| |
Change History
3 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 14, 2026 | CVE Modified | [email protected] |
| Jun 30, 2026 | CVE Modified | CISA-ADP |
| Jun 30, 2026 | New CVE Received | [email protected] |