CVE-2026-10154CWE-285CWE-639

Dolibarr ERP CRM messaging.php authorization

Medium · published May 30, 2026

CVSS v4.0
5.3
EPSS
0%
Percentile
12.2
In the wild
Unconfirmed
What it is

A vulnerability has been found in Dolibarr ERP CRM 23.0.0/23.0.1/23.0.2. The affected element is an unknown function of the file htdocs/user/messaging.php. Such manipulation of the argument ID leads to authorization bypass. The attack can be executed remotely. Upgrading to version 23.0.3 is sufficient to fix this issue. The name of the patch is 119b3606c7a701747a57a1f18b1a9e7666f678e2. It is suggested to upgrade the affected component.

The record
Technical detail
CVSS v4.0
5.3 · MEDIUM
Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X
EPSS
0.00223 · 12.2th percentile
Weaknesses
CWE-285 · Improper Authorization; CWE-639 · Authorization Bypass Through User-Controlled Key
Published
2026-05-30T23:00Z
EPSS history
Timeline
  • 30 MAY 23:00Z
    Dolibarr ERP CRM messaging.php authorization
    cvelistv5