Authorization Bypass in Dolibarr ERP CRM Messaging Function

CVE-2026-10154

What is CVE-2026-10154?

A security vulnerability has been identified in the messaging.php component of Dolibarr ERP CRM versions 23.0.0 through 23.0.2. This vulnerability allows attackers to bypass authorization mechanisms by manipulating the ID argument, which may lead to unauthorized access to sensitive information. Remote exploitation of this issue poses significant risks, making it imperative for users to upgrade to version 23.0.3, which includes a patch to rectify this flaw. Ensuring that your system is updated will help mitigate potential security threats.

References