CVE-2026-10215: Dolibarr Leave Request API Authorization Bypass

Technical summary

CVE-2026-10215 is an improper authorization flaw in the checkUserAccessToObject function within htdocs/holiday/class/api_holidays.class.php of Dolibarr's Leave Request REST API. The authorization check fails to enforce proper access controls, allowing an authenticated user to read leave request records outside their authorization scope. The vulnerability is network-accessible and requires only valid authentication credentials (no elevated privileges needed). It affects confidentiality but not integrity or availability. Dolibarr addressed this in version 23.0.2 via commit ee93b6f2f9dd0f6aeefe9d718ab3ab0a44326b73.

Business impact

Unauthorized disclosure of employee leave and time-off data could expose sensitive HR information, creating privacy and compliance risks. In regulated industries (healthcare, finance, government), exposure of leave schedules and patterns may trigger data protection obligations. The moderate CVSS score reflects that this is confidentiality-focused, but the public exploit disclosure and ease of exploitation (authenticated access only) increase operational risk. Organizations relying on Dolibarr for leave management should treat this as a near-term remediation priority.

Affected systems

Dolibarr ERP CRM versions up to and including 23.0.1 are affected. The vulnerability exists in the REST API's Leave Request module. Any deployment using this ERP/CRM system for leave request management is at risk if not patched. The API nature means the flaw may be exploited by any application or user holding valid API credentials or session authentication.

Exploitability

The vulnerability is easily exploitable. It requires only valid user authentication to trigger—no elevated privileges, special configuration, or complex interaction is needed. The attack is initiated remotely over the network via standard REST API calls. Because the exploit has been publicly disclosed, attackers have proof-of-concept information and the technical barrier to exploitation is very low. The combination of public disclosure and low exploitation complexity makes this an attractive target for both opportunistic and targeted attacks.

Remediation

Upgrade Dolibarr ERP CRM to version 23.0.2 or later. This version includes the authorization logic fix (commit ee93b6f2f9dd0f6aeefe9d718ab3ab0a44326b73). Organizations unable to upgrade immediately should restrict API access to the Leave Request endpoint using network controls or WAF rules, limit authentication scope, and monitor API logs for unusual leave request queries. Verify the upgrade against the official Dolibarr advisory to confirm patch application.

Patch guidance

Apply Dolibarr version 23.0.2 or later. The fix is available in the official release; verify that your installed version's commit hash matches or supersedes ee93b6f2f9dd0f6aeefe9d718ab3ab0a44326b73. Before patching production, test in a non-production environment to ensure compatibility with customizations or integrations. If you have deployed custom REST API endpoints or extensions that depend on the Leave Request API, review their logic post-patch to ensure they still function correctly.

Detection guidance

Monitor REST API logs for anomalous leave request queries, particularly GET requests to leave endpoints from users or API keys that do not manage those records. Look for patterns such as sequential API calls accessing other users' leave data, rapid enumeration of leave IDs, or API access from unexpected IP ranges. Implement API request logging with user and resource context to enable forensic analysis. Review recent API access logs (particularly since the public disclosure date, June 1, 2026) for signs of exploitation.

Why prioritize this

Although the CVSS score is moderate (4.3), the public exploit disclosure and low barrier to exploitation significantly raise practical risk. Any attacker with valid credentials can immediately exploit this flaw. The data exposed (leave schedules) may trigger regulatory notification obligations in certain jurisdictions. The ease of patching (direct upgrade to 23.0.2) and the high signal-to-noise ratio of detection make this a high-value remediation target for most organizations running Dolibarr.

Risk score, explained

The CVSS 3.1 score of 4.3 reflects a network-accessible, low-complexity attack requiring authentication, with confidentiality impact but no integrity or availability impact. However, the public exploit disclosure elevates practical risk beyond the base score. This is a high-priority fix relative to other moderate-severity flaws because it combines ease of exploitation, ease of detection, and ease of patching into a low-friction remediation opportunity.

Frequently asked questions