CVE-2026-58376: Dolibarr - SQL Injection via sqlfilters Parameter in Multiple REST API List Endpoints
Dolibarr through 23.0.3, fixed in commit 14db36e, contains a sql injection vulnerability that allows authenticated API users to exfiltrate arbitrary database contents by supplying malicious values to the sqlfilters query parameter in the setup dictionary and multicurrencies REST API endpoints. The affected endpoints in apisetup.class.php and apimulticurrencies.class.php validate sqlfilters only for balanced parentheses and rewrite matched triplets, allowing text placed outside the expected shape such as an appended UNION SELECT to be concatenated into the SQL WHERE clause unmodified, enabling retrieval of sensitive data including password hashes and API keys.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Dolibarrto a version that resolves this vulnerability.Fixed in 23.0.3Patch 14db36e - Compensating control
Restrict access to the affected Dolibarr REST API endpoints (api_setup.class.php and api_multicurrencies.class.php) so that only trusted, authenticated users can call them, reducing the risk of SQL injection data exfiltration via the sqlfilters query parameter.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-58376?
CVE-2026-58376 has a high severity rating of 7.6.
How do I fix CVE-2026-58376?
CVE-2026-58376 can be fixed by upgrading to Dolibarr version 23.0.4 or later, which addresses the SQL injection vulnerability.
What type of vulnerability is CVE-2026-58376?
CVE-2026-58376 is an SQL injection vulnerability found in Dolibarr.
Who is affected by CVE-2026-58376?
Authenticated API users utilizing the affected REST API endpoints in Dolibarr versions prior to 23.0.4 are at risk from CVE-2026-58376.
What can attackers do with CVE-2026-58376?
Attackers exploiting CVE-2026-58376 can exfiltrate arbitrary database contents by supplying malicious values to the sqlfilters parameter.