CVE-2026-116218: Dolibarr ERP CRM 19.0.0 before 23.0.4 SQL Injection via bankaccounts API type field
Dolibarr ERP CRM 19.0.0 before 23.0.4 contains an SQL injection vulnerability that allows authenticated API users to inject SQL via the type field of the third-party bankaccounts REST endpoint. Attackers with only societe/creer permission can break out of the unescaped type value in CompanyBankAccount::create() to read password hashes and API keys via time-based blind subqueries.
Affected Software
Event History
Frequently Asked Questions
Which users could exploit this issue?
An authenticated API user with the societe/creer permission is sufficient. No higher administrative permission or user interaction is indicated.
Which deployments are affected?
Dolibarr ERP CRM versions from 19.0.0 up to, but not including, 23.0.4 are affected. The vulnerable path is the third-party bankaccounts REST endpoint.
What could an attacker obtain through exploitation?
The issue can be used for time-based blind SQL subqueries to read password hashes and API keys. The reported impact also includes limited integrity and availability effects.
What should be prioritized if remediation cannot be applied immediately?
Restrict API access for accounts that have the societe/creer permission, especially where those accounts do not need to create third-party bank accounts. Monitor use of the third-party bankaccounts REST endpoint and review exposed credentials such as API keys and password hashes.