Login Request a demo
Medium severity · published Jun 9, 2026
CVE-2026-11619
Dolibarr ERP CRM Legacy Filemanager config.inc.php improper authorization
6.3
CVSS
0.2%
EPSS
No
On KEV
Description
A vulnerability was identified in Dolibarr ERP CRM up to 23.0.2. The impacted element is an unknown function of the file htdocs/core/filemanagerdol/connectors/php/config.inc.php of the component Legacy Filemanager. The manipulation leads to improper authorization. It is possible to initiate the attack remotely. The exploit is publicly available and might be used. Upgrading to version 23.0.3 is sufficient to resolve this issue. The identifier of the patch is f1b2dd6481e22cacb561d29ffdcd3a50b618479d. Upgrading the affected component is advised.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
Low
Integrity
Low
Availability
Low
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.2% · higher than 11% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
EC
ERP CRM · Dolibarr
23.0.0; 23.0.1; 23.0.2 · source: vendor
Affected product
EC
ERP CRM
Dolibarr
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-11619
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-11619
github.com
https://github.com/Dolibarr/dolibarr/releases/tag/23.0.3
github.com
https://github.com/dolibarr/dolibarr/commit/f1b2dd6481e22cacb561d29ffdcd3a50b618479d
vuldb.com
https://vuldb.com/cve/CVE-2026-11619
vuldb.com
https://vuldb.com/submit/834038
vuldb.com
https://vuldb.com/vuln/369300
vuldb.com
https://vuldb.com/vuln/369300/cti
More from ERP CRM
5.0
CVE-2026-7688
Dolibarr ERP CRM Shipments API Endpoint expedition.class.php _checkValForAPI sql injection
4.3
CVE-2026-10215
Dolibarr ERP CRM Leave Request REST API api_holidays.class.php checkUserAccessToObject improper authorization
4.3
CVE-2026-10154
Dolibarr ERP CRM messaging.php authorization
3.7
CVE-2026-7689
Dolibarr ERP CRM Online Signature security.lib.php dol_verifyHash signature verification