Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

CVE-2026-58376: Dolibarr SQL Injection through API Endpoints

CVE-2026-58376 · published 4 months ago

Summary

Dolibarr, a business management software, has a security issue that allows authorized users to access sensitive data by sending malicious requests to its API. This issue affects users who rely on Dolibarr for secure data storage, and it's essential to update to the latest version to prevent unauthorized data access. Update Dolibarr to version 23.0.4 or later to fix this issue.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software

Vendor	Product	Affected versions
dolibarr	dolibarr	<= 23.0.3

Original advisory text

Dolibarr - SQL Injection via sqlfilters Parameter in Multiple REST API List Endpoints

Dolibarr through 23.0.3, fixed in commit 14db36e, contains a sql injection vulnerability that allows authenticated API users to exfiltrate arbitrary database contents by supplying malicious values to the sqlfilters query parameter in the setup dictionary and multicurrencies REST API endpoints. The affected endpoints in api_setup.class.php and api_multicurrencies.class.php validate sqlfilters only for balanced parentheses and rewrite matched triplets, allowing text placed outside the expected shape such as an appended UNION SELECT to be concatenated into the SQL WHERE clause unmodified, enabling retrieval of sensitive data including password hashes and API keys.

References

https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/58xxx/CVE-2026-58376... Vendor Advisory
https://nvd.nist.gov/vuln/detail/CVE-2026-58376 Vendor Advisory
https://www.vulncheck.com/advisories/dolibarr-sql-injection-via-sqlfilters-param... Vendor Advisory
https://github.com/Dolibarr/dolibarr/pull/38794 Third Party Advisory
https://github.com/Dolibarr/dolibarr/commit/14db36e8486ef725b0d493d97abb2950a543... Patch
https://github.com/Dolibarr/dolibarr Product
https://github.com/Dolibarr/dolibarr/issues/38768 Exploit

Fix within

Internet-facing 60 days

Internal At next upgrade

Not known to be exploited
Needs hands-on effort to exploit
Gives an attacker partial control

Severity

8.4 High

Exploitation

<1% chance of attack within 30 days

Type

CWE-89SQL Injection

Timeline

Published30 Jun 2026

Updated4 Nov 2026

First seen30 Jun 2026

Sources

CVE-2026-58376 · NVD

CVE-2026-58376 · MITRE

CVE-2026-58376 · OSV

Track software like this

Free during beta