CVE-2025-69634: CSRF
Cross Site Request Forgery vulnerability in Dolibarr ERP & CRM v.22.0.9 allows a remote attacker to escalate privileges via the notes field in perms.php NOTE: this is disputed by a third party who indicates that exploitation can only occur if an unprivileged user knows the token of an admin user.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-69634?
CVE-2025-69634 has been assessed as a moderate severity vulnerability due to its potential for privilege escalation.
How do I fix CVE-2025-69634?
To mitigate CVE-2025-69634, ensure that you update Dolibarr ERP & CRM to the latest version that addresses this vulnerability.
Who is affected by CVE-2025-69634?
CVE-2025-69634 affects all users of Dolibarr ERP & CRM version 22.0.9 and potentially earlier versions.
Can CVE-2025-69634 be exploited by unprivileged users?
CVE-2025-69634 may only be exploitable if an unprivileged user possesses the token of an admin user, according to some dispute by third parties.
What attack vector is used in CVE-2025-69634?
CVE-2025-69634 leverages a Cross Site Request Forgery attack vector through the notes field in perms.php.