CVE-2026-116218— Dolibarr ERP CRM 19.0.0 before 23.0.4 SQL Injection via bankaccounts API type field

Quick assessment

Affected

Dolibarr dolibarr

Exploitation

No confirmed in-the-wild exploitation; assess based on exposure

Recommended action

Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Dolibarr ERP CRM 19.0.0 至 23.0.4 版本（不含 23.0.4）存在 SQL 注入漏洞。已认证的 API 用户可通过第三方银行账户（third-party bankaccounts）REST 端点的字段注入 SQL 语句。仅拥有权限的攻击者，可利用方法中未转义的值，通过基于时间的盲注子查询，读取密码哈希值及 API 密钥。

CVSS 7.6 · High Updated Oct 26, 2026

Possible ATT&CK Techniques 2 AI

T1059.007 · JavaScript T1190 · Exploit Public-Facing Application

Get alerts for future matching vulnerabilities Log in to subscribe

Vulnerability Information

Have questions about the vulnerability? See if Shenlong's analysis helps!

View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title

Dolibarr ERP CRM 19.0.0 before 23.0.4 SQL Injection via bankaccounts API type field

Source: CVE Program / CVE List V5

Vulnerability Description

Dolibarr ERP CRM 19.0.0 before 23.0.4 contains an SQL injection vulnerability that allows authenticated API users to inject SQL via the type field of the third-party bankaccounts REST endpoint. Attackers with only societe/creer permission can break out of the unescaped type value in CompanyBankAccount::create() to read password hashes and API keys via time-based blind subqueries.

Source: CVE Program / CVE List V5

CVSS Information

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L

Source: CVE Program / CVE List V5

Vulnerability Type

SQL命令中使用的特殊元素转义处理不恰当(SQL注入)

Source: CVE Program / CVE List V5

Affected Products

Vendor	Product	Affected Versions	CPE	Subscribe
Dolibarr	dolibarr	19.0.0 ~ 23.0.4	-

II. Public POCs for CVE-2026-116218

#	POC Description	Source Link	Shenlong Link

AI-Generated POC Premium

No public POC found.

III. Intelligence Information for CVE-2026-116218

请登录查看更多情报信息。

Other References for CVE-2026-116218 (4)

https://github.com/Dolibarr/dolibarr/blob/23.0.3/htdocs/societe/class/api_thirdparties.class.php#L1852 technical-description
https://github.com/Dolibarr/dolibarr/blob/23.0.3/htdocs/societe/class/companybankaccount.class.php#L399 technical-description
https://github.com/Dolibarr/dolibarr/commit/19991c8ffa9b4fd7338b7ef2585fadb554b86735 patch
https://www.vulncheck.com/advisories/dolibarr-erp-crm-19.0.0-before-23.0.4-sql-injection-via-bankaccounts-api-type-field third-party-advisory

https://www.cve.org/CVERecord?id=CVE-2026-116218

IV. Related Vulnerabilities

Same product: dolibarr

Same vendor: Dolibarr

Same weakness: CWE-89