SQL Injection Vulnerability in Dolibarr ERP CRM by Dolibarr

CVE-2026-116218

What is CVE-2026-116218?

A vulnerability in Dolibarr ERP CRM versions prior to 23.0.4 allows authenticated users with limited permissions to exploit the bank accounts API. This SQL injection risk permits attackers to manipulate the type field, enabling them to extract sensitive information, such as password hashes and API keys, through time-based blind SQL queries. The issue arises from improper validation of the type variable during the creation of company bank accounts. Organizations using affected versions should implement the latest security patches to mitigate this risk.

References