Security readout for executives and security teams
Plain-English summary
Dolibarr ERP CRM has an authorization flaw in its user messaging page. A remote logged-in user may be able to manipulate an ID value and bypass intended access controls. The cited fix is version 23.0.3. No source in the bundle confirms active exploitation.
Executive priority
Prioritize patching on internet-facing or multi-user Dolibarr deployments. This is not a critical outage-level issue, but authorization bypasses can expose internal messages or user-related data and should be remediated in the next normal security maintenance window.
Technical view
CVE-2026-10154 is a CWE-285/CWE-639 authorization bypass affecting htdocs/user/messaging.php in Dolibarr ERP CRM 23.0.0 through 23.0.2. The issue involves server-side trust of an ID argument. CVSS 4.0 is 5.3: network exploitable, low complexity, low privileges required, and limited confidentiality impact.
Likely exposure
Exposure is most likely on Dolibarr ERP CRM 23.0.0, 23.0.1, or 23.0.2 where untrusted or broad user access exists. The bundle inconsistently lists 23.0.3 as affected, but also states 23.0.3 fixes the issue.
Exploitation context
The attack is described as remote and requiring low privileges. The source bundle does not include exploit code, public exploitation evidence, or KEV listing. Treat exploitation status as unconfirmed unless later vendor, KEV, or incident sources say otherwise.
Researcher notes
The useful technical classification is IDOR-style authorization bypass: CWE-639 plus CWE-285. Sources identify the vulnerable file and ID argument, but not the exact function, data object, or complete impact boundary. Avoid assuming integrity or availability impact beyond the provided CVSS vector.
Mitigation direction
- Upgrade Dolibarr ERP CRM to version 23.0.3 or later per cited guidance.
- Confirm the patch commit 119b3606c7a701747a57a1f18b1a9e7666f678e2 is present.
- Restrict Dolibarr access to trusted users until upgrade is complete.
- Review vendor guidance for any additional hardening or backport instructions.
Validation and detection
- Inventory Dolibarr instances and record exact ERP CRM versions.
- Check whether htdocs/user/messaging.php matches the 23.0.3 patched codebase.
- Confirm user messaging access enforces expected ownership and authorization controls.
- Review application logs for unusual messaging-page access by low-privileged users.
Public sources used
- CVE Program
- CVE List V5
- VDB-367407 | Dolibarr ERP CRM messaging.php authorization
- VDB-367407 | CTI Indicators (IOB, IOC, IOA)
- Submit #818838 | Dolibarr ERP CRM 23.0.0 23.0.1 23.0.2 Trusting HTTP Permission Methods on the Server Side
- Dolibarr patch commit 119b3606c7a701747a57a1f18b1a9e7666f678e2
- Dolibarr release 23.0.3
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-285: Exact CWE lookup
Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCWE-639: Exact CWE lookup
Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupPrivilege behavior lookup
The CVE wording references privilege impact, so privilege escalation and authorization behavior review may help. This is a Glexia inferred lookup path, not an official MITRE, ATT&CK, or CVE Program mapping.
Open ATT&CK lookupCVE-2026-10154 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Medium
- CVSS
- 5.3 (4.0)
- Known Exploited
- No
- Published
Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
SSVC decision data
CVSS vector scores
4 official scoresWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X——VulDBCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N/E:X/RL:O/RC:C2.81.4VulDBCVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N/E:X/RL:O/RC:C2.81.4VulDBAV:N/AC:L/Au:S/C:P/I:N/A:N/E:ND/RL:OF/RC:C82.9VulDBVulnerability scoring details
Base CVSS 4.0 score
5.3MediumVector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X
Base CVSS 3.1 score
4.3MediumVector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N/E:X/RL:O/RC:C
Base CVSS 3.0 score
4.3MediumVector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N/E:X/RL:O/RC:C
Base CVSS 2.0 score
4MediumVector: AV:N/AC:L/Au:S/C:P/I:N/A:N/E:ND/RL:OF/RC:C
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- Source timelineVulDB
Advisory disclosed
- Source timelineVulDB
VulDB entry created
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- Source timelineVulDB
VulDB entry last update
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- VDB-367407 | Dolibarr ERP CRM messaging.php authorizationCVE reference, VulDB · vdb-entry, technical-description
- VDB-367407 | CTI Indicators (IOB, IOC, IOA)CVE reference, VulDB · signature, permissions-required
- Submit #818838 | Dolibarr ERP CRM 23.0.0 23.0.1 23.0.2 Trusting HTTP Permission Methods on the Server SideCVE reference, VulDB · third-party-advisory
- https://github.com/dolibarr/dolibarr/commit/119b3606c7a701747a57a1f18b1a9e7666f678e2CVE reference, VulDB · patch
- https://github.com/Dolibarr/dolibarr/releases/tag/23.0.3CVE reference, VulDB · patch
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Improper Authorization
Improper Authorization represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.
Authorization Bypass Through User-Controlled Key
Authorization Bypass Through User-Controlled Key represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.