CVE-2026-11619: Dolibarr ERP CRM Authorization Bypass in Legacy Filemanager

Technical summary

CVE-2026-11619 affects Dolibarr ERP CRM through version 23.0.2 and involves an authorization bypass in htdocs/core/filemanagerdol/connectors/php/config.inc.php within the Legacy Filemanager component. The vulnerability stems from improper authorization logic (CWE-266, CWE-285), allowing authenticated users to perform actions beyond their assigned permissions. The attack vector is network-accessible, requires login credentials (PR:L), and operates in the user's security context (S:U). Remediation is available via patch f1b2dd6481e22cacb561d29ffdcd3a50b618479d, included in version 23.0.3.

Business impact

Organizations running Dolibarr ERP CRM are at risk of unauthorized data access and modification by authenticated insiders or compromised accounts. Since the Legacy Filemanager component often handles document storage and retrieval, exploitation could expose sensitive business documents, financial records, or confidential project files. The presence of public exploit code significantly raises the likelihood of opportunistic attacks. For supply chain deployments, this affects any organization depending on hosted or managed Dolibarr instances running vulnerable versions.

Affected systems

Dolibarr ERP CRM versions up to and including 23.0.2 are vulnerable. The Legacy Filemanager component is the attack surface. Organizations should identify deployed instances using version 23.0.2 or earlier and prioritize those in direct contact with untrusted networks or multi-tenant environments.

Exploitability

Exploitability is moderate to high. The vulnerability requires valid authentication credentials, limiting attack surface to users with system access. However, the network accessibility, absence of complex interaction requirements, and availability of public exploit code substantially increase practical exploitation risk. Insider threats and lateral movement by account compromise are primary concerns. The CVSS 3.1 score of 6.3 reflects medium severity with confidentiality, integrity, and availability impact.

Remediation

Upgrade Dolibarr ERP CRM to version 23.0.3 or later. The patch resolves authorization enforcement in the config.inc.php file. Organizations unable to upgrade immediately should restrict access to the filemanagerdol component via network controls and review file manager access logs for unauthorized activity.

Patch guidance

Apply Dolibarr ERP CRM version 23.0.3 or later. Verify the patch commit hash matches f1b2dd6481e22cacb561d29ffdcd3a50b618479d in your deployment. Test in a staging environment before production deployment to ensure compatibility with custom configurations or dependent modules. For hosted deployments, confirm with your provider that instances have been updated.

Detection guidance

Monitor access logs for the htdocs/core/filemanagerdol/connectors/php/config.inc.php file, particularly requests from authenticated users with unusual privilege elevation or cross-departmental file access patterns. Review file manager activity logs for access to sensitive documents outside normal business workflows. Implement authentication and authorization telemetry to detect privilege escalation attempts within the ERP system. Network IDS/IPS signatures targeting Legacy Filemanager exploitation may be available from security vendors.

Why prioritize this

Despite a CVSS score of 6.3 (medium), this vulnerability merits expedited patching due to public exploit availability and the sensitive nature of ERP systems. Finance, healthcare, and manufacturing sectors using Dolibarr should prioritize immediate upgrades. The low attack complexity and requirement for authentication only (rather than zero-day complexity) make this a realistic threat in competitive or malicious insider scenarios.

Risk score, explained

CVSS 3.1 assigns a score of 6.3 because the vulnerability requires authenticated access (PR:L), has low attack complexity, and impacts confidentiality, integrity, and availability equally. The network vector (AV:N) and lack of scope change reflect the severity. The score does not account for the real-world amplification provided by public exploit code, which argues for treating this as a priority-one fix in environments where Dolibarr holds sensitive data.

Frequently asked questions