CVE-2026-10154

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-10154
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-10154.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-10154
Downstream
Published
2026-05-30T23:00:13.659Z
Modified
2026-07-15T01:49:15.141735116Z
Severity
  • 5.3 (Medium) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X CVSS Calculator
Summary
Dolibarr ERP CRM messaging.php authorization
Details

A vulnerability has been found in Dolibarr ERP CRM 23.0.0/23.0.1/23.0.2. The affected element is an unknown function of the file htdocs/user/messaging.php. Such manipulation of the argument ID leads to authorization bypass. The attack can be executed remotely. Upgrading to version 23.0.3 is sufficient to fix this issue. The name of the patch is 119b3606c7a701747a57a1f18b1a9e7666f678e2. It is suggested to upgrade the affected component.

Database specific 
{
    "cwe_ids": [
        "CWE-285",
        "CWE-639"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/10xxx/CVE-2026-10154.json",
    "cna_assigner": "VulDB"
}
References

Affected packages

Git / github.com/dolibarr/dolibarr

Affected ranges

Type
GIT
Repo
https://github.com/dolibarr/dolibarr
Events
Introduced
58852eaa57ceed5dd95cc82d676ab52778fa45bd
Fixed
57d0be7dc97140d7d47e826875ba9256ec3b6357
Fixed
119b3606c7a701747a57a1f18b1a9e7666f678e2
Database specific 
{
    "extracted_events": [
        {
            "introduced": "23.0.0"
        },
        {
            "last_affected": "23.0.0"
        },
        {
            "introduced": "23.0.1"
        },
        {
            "last_affected": "23.0.1"
        },
        {
            "introduced": "23.0.2"
        },
        {
            "last_affected": "23.0.2"
        }
    ],
    "source": [
        "AFFECTED_FIELD",
        "REFERENCES"
    ]
}

Affected versions

23.*
23.0.0
23.0.1
23.0.2

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-10154.json"