CVE-2026-116218
Deferred Deferred - Pending Action

SQL Injection in Dolibarr ERP CRM API

Publication date: 2026-10-26

Last updated on: 2026-10-26

Assigner: VulnCheck

Description
Dolibarr ERP CRM 19.0.0 before 23.0.4 contains an SQL injection vulnerability that allows authenticated API users to inject SQL via the type field of the third-party bankaccounts REST endpoint. Attackers with only societe/creer permission can break out of the unescaped type value in CompanyBankAccount::create() to read password hashes and API keys via time-based blind subqueries.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-26
Last Modified
2026-10-26
Generated
2026-10-26
AI Q&A
2026-10-26
EPSS Evaluated
N/A
NVD
CVE-2026-116218
EUVD
EUVD-2026-109810

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
Dolibarr dolibarr 19.0.0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-89 The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is an SQL injection vulnerability in Dolibarr ERP CRM versions 19.0.0 through 23.0.3. It affects the type field of the third-party bankaccounts REST API endpoint. Authenticated users with societe/creer permission can inject malicious SQL queries to read sensitive data like password hashes and API keys via time-based blind subqueries.

Detection Guidance

To detect this SQL injection vulnerability in Dolibarr, check API logs for suspicious requests targeting the bankaccounts endpoint with the type field. Look for time-based blind SQLi patterns like delayed responses or error messages. Use tools like sqlmap to test the endpoint: sqlmap -u 'http://target/dolibarr/api/index.php/bankaccounts?type=1' --data='type=1' --batch --level=5 --risk=3.

Impact Analysis

An attacker with limited privileges could exploit this to extract sensitive data such as password hashes and API keys from the database. This could lead to further compromise of user accounts or unauthorized access to system functions.

Compliance Impact

This vulnerability could lead to unauthorized access to personal or sensitive data, violating GDPR and HIPAA requirements for data protection and access controls. Organizations using affected versions may face compliance violations and potential legal consequences.

Mitigation Strategies

Immediately upgrade Dolibarr to version 23.0.4 or later. If upgrading is not possible, apply the patch from commit 19991c8 to escape the type field in companybankaccount.class.php. Restrict API access to trusted users and review societe/creer permissions. Monitor API traffic for unusual queries.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-116218. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart