CVE-2026-107706 Dolibarr CVE debrief

Who should care

Defenders responsible for Dolibarr ERP CRM systems, particularly those with read-only user accounts, should assess exposure and prioritize verification and remediation to prevent potential unauthorized modifications. This includes reviewing system configurations, identifying potentially affected components, and applying necessary patches or mitigations. Additionally, defenders should monitor for suspicious activity and review compensating controls for ExPO

Why it matters

CVE-2026-107706 is a medium-severity vulnerability in Dolibarr ERP CRM that allows read-only users to modify extrafields on certain objects. Defenders should prioritize verification and remediation to prevent potential unauthorized modifications.

• Read-only users can modify extrafields on certain objects
• Persistent modifications can be made to extrafields on viewable objects
• Defenders need to verify and restrict access to the updateextrafield.php file

Technical summary

The updateextrafield.php file in Dolibarr ERP CRM before version 24.0.2 does not properly check permissions before writing extrafield values. This allows authenticated users with read-only access to POST objectType, objectId, field, and value parameters, potentially modifying extrafields on viewable third parties, products, members, projects, or contacts. The vulnerability is caused by a lack of proper authorization checks in the updateextrafield.php file, which can lead to persistent modifications of extrafields on certain objects.

Defensive priority

Defenders should prioritize verifying and upgrading to version 24.0.2 or later, and restrict access to the updateextrafield.php file.

Recommended defensive actions

• Verify and upgrade to version 24.0.2 or later
• Restrict access to the updateextrafield.php file
• Monitor for suspicious activity on third parties, products, members, projects, and contacts
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The vulnerability exists in the updateextrafield.php file, which does not properly check permissions before writing extrafield values. This allows read-only users to make persistent modifications to extrafields on viewable objects.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.