UBUNTU-CVE-2026-116218: SQL Injection

Published Oct 26, 2026

Updated

Dolibarr ERP CRM 19.0.0 before 23.0.4 contains an SQL injection vulnerability that allows authenticated API users to inject SQL via the type field of the third-party bankaccounts REST endpoint. Attackers with only societe/creer permission can break out of the unescaped type value in CompanyBankAccount::create() to read password hashes and API keys via time-based blind subqueries.

Affected Software

1 affected component

ubuntu/dolibarr*

Event History

Oct 26, 2026

CVE Published

via OSV·02:16 PM

Data Sourced

via OSV·02:16 PM

DescriptionSeverityAffected Software

Frequently Asked Questions

Which accounts can exploit this issue?

An authenticated API user with the societe/creer permission can exploit the injection. No higher administrative permission is stated as necessary.

What access could an attacker obtain?

The issue can be used with time-based blind SQL subqueries to read password hashes and API keys. The listed impact also includes limited integrity and availability effects.

Which endpoint and input should be monitored while remediating?

Focus on requests to the third-party bankaccounts REST endpoint, specifically values supplied in the type field. The vulnerable path is the unescaped type value processed by CompanyBankAccount::create().

Which versions are affected?

Dolibarr ERP CRM versions from 19.0.0 before 23.0.4 are affected. Version 23.0.4 is identified as the boundary after the vulnerable range.

UBUNTU-CVE-2026-116218: SQL Injection

Affected Software

Event History

Frequently Asked Questions

Which accounts can exploit this issue?

What access could an attacker obtain?

Which endpoint and input should be monitored while remediating?

Which versions are affected?

Company

Resources

Contact

Frequently Asked Questions

Which accounts can exploit this issue?

What access could an attacker obtain?

Which endpoint and input should be monitored while remediating?

Which versions are affected?