CVE-2026-85401
Received Received - Intake

Improper Access Control in Dolibarr File Manager

Publication date: 2026-09-04

Last updated on: 2026-09-04

Assigner: VulDB

Description
A weakness has been identified in Dolibarr up to 21.0.4/22.0.5/23.0.3. Affected by this issue is some unknown functionality of the file htdocs/core/filemanagerdol/connectors/php/config.inc.php of the component Legacy File Manager. Executing a manipulation can lead to improper access controls. The attack can be launched remotely. The exploit has been made available to the public and could be used for attacks. Upgrading to version 23.0.4 can resolve this issue. This patch is called ef6631e9bd5ec4b8cec0e88f1796d3d10dad02ec. It is suggested to upgrade the affected component.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-04
Last Modified
2026-09-04
Generated
2026-09-04
AI Q&A
2026-09-04
EPSS Evaluated
N/A
NVD
CVE-2026-85401
EUVD
EUVD-2026-70872

Affected Vendors & Products

Showing 4 associated CPEs
Vendor Product Version / Range
dolibarr dolibarr to 21.0.4 (inc)
dolibarr dolibarr to 22.0.5 (inc)
dolibarr dolibarr to 23.0.3 (inc)
dolibarr dolibarr 23.0.4

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-284 The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.
CWE-266 A product incorrectly assigns a privilege to a particular actor, creating an unintended sphere of control for that actor.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is a broken access control issue in Dolibarr's legacy file manager (FCKeditor connector). It allows users with insufficient permissions to bypass authorization checks and gain unauthorized access to file operations like uploading files or browsing directories. The flaw exists in versions up to 21.0.4/22.0.5/23.0.3 due to missing permission validation in config.inc.php.

Detection Guidance

Check for unauthorized file uploads or modifications in the medias directory. Inspect the config.inc.php file in htdocs/core/filemanagerdol/connectors/php/ for missing permission checks. Verify if non-admin users can access or upload files via the legacy file manager endpoint.

Impact Analysis

An attacker could exploit this to upload malicious files, modify existing files, or access sensitive directories containing credentials or configuration files. This could lead to data theft, system compromise, or further attacks on the server. The exploit is publicly available and requires only low-privileged access.

Compliance Impact

This vulnerability could violate compliance requirements by enabling unauthorized data access or modification. GDPR requires protecting personal data, while HIPAA mandates securing health information. Exploits could lead to breaches, triggering regulatory penalties, fines, or legal consequences for non-compliance.

Mitigation Strategies

Upgrade Dolibarr to version 23.0.4 or apply the patch ef6631e9bd5ec4b8cec0e88f1796d3d10dad02ec. Ensure the legacy file manager enforces proper permission checks by reviewing config.inc.php and browser.php for correct authorization logic.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-85401. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart