Medium severity · published Jun 1, 2026
CVE-2026-10215
Dolibarr ERP CRM Leave Request REST API api_holidays.class.php checkUserAccessToObject improper authorization
4.3
CVSS
0.3%
EPSS
No
On KEV
Description
A security vulnerability has been detected in Dolibarr ERP CRM up to 23.0.1. Impacted is the function checkUserAccessToObject of the file htdocs/holiday/class/api_holidays.class.php of the component Leave Request REST API. The manipulation leads to improper authorization. The attack may be initiated remotely. The exploit has been disclosed publicly and may be used. Upgrading to version 23.0.2 is recommended to address this issue. The identifier of the patch is ee93b6f2f9dd0f6aeefe9d718ab3ab0a44326b73. Upgrading the affected component is advised.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
Low
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 18% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
EC
ERP CRM · Dolibarr
23.0.0; 23.0.1 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-10215
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-10215
github.com
https://github.com/Dolibarr/dolibarr/commit/ee93b6f2f9dd0f6aeefe9d718ab3ab0a44326b73
github.com
https://github.com/Dolibarr/dolibarr/issues/37752
github.com
https://github.com/Dolibarr/dolibarr/issues/37752#issuecomment-4304055921
github.com
https://github.com/Dolibarr/dolibarr/releases/tag/23.0.2
github.com
https://github.com/user-attachments/files/26487388/2_Dolibarr_Leave_Request_API_Horizontal_Unauthorized_Read_en.pdf
vuldb.com
https://vuldb.com/cve/CVE-2026-10215
More from ERP CRM
6.3
CVE-2026-11619
Dolibarr ERP CRM Legacy Filemanager config.inc.php improper authorization
5.0
CVE-2026-7688
Dolibarr ERP CRM Shipments API Endpoint expedition.class.php _checkValForAPI sql injection
4.3
CVE-2026-10154
Dolibarr ERP CRM messaging.php authorization
3.7
CVE-2026-7689
Dolibarr ERP CRM Online Signature security.lib.php dol_verifyHash signature verification