https://db.gcve.eu/rss/recent/all/10 Most recent entries from all 2026-10-11T02:23:00.444051+00:00 Vulnerability-Lookup info@gcve.eu python-feedgen Contains only the most 10 recent entries. https://db.gcve.eu/vuln/cve-2026-107706 CVE-2026-107706 — Dolibarr before 24.0.2 Incorrect Authorization via updateextrafield.php 2026-10-11T02:23:00.445423+00:00

Affected: dolibarr

Dolibarr ERP CRM before 24.0.2 contains an incorrect authorization vulnerability in htdocs/core/ajax/updateextrafield.php that checks only read permission before writing extrafield values. Authenticated users with read-only access can POST objectType, objectId, field and value parameters to persistently modify extrafields on viewable third parties, products, members, projects or contacts.