CVE-2026-107706
Last modified
CVE-2026-107706 is a medium-severity vulnerability rated 4.3/10 on the CVSS scale. Dolibarr ERP CRM before 24.0.2 contains an incorrect authorization vulnerability in htdocs/core/ajax/updateextrafield.php that checks only read permission before writing extrafield values. Authenticated users with read-only access can POST objectType, objectId, field and value parameters to persistently modify extrafields on viewable third parties, products, members, projects or contacts..
Description
Dolibarr ERP CRM before 24.0.2 contains an incorrect authorization vulnerability in htdocs/core/ajax/updateextrafield.php that checks only read permission before writing extrafield values. Authenticated users with read-only access can POST objectType, objectId, field and value parameters to persistently modify extrafields on viewable third parties, products, members, projects or contacts.
Metrics
Weakness Enumeration
References
Timeline
- Published
- Last Modified
- Status
- Deferred
Frequently Asked Questions
What is CVE-2026-107706?
How severe is CVE-2026-107706?
How do I fix CVE-2026-107706?
How Strix Helps
- Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2026
- CVE-2026-107700dot-access 0.0.3 through 1.0.0 contains a code injection vul…9.8
- CVE-2026-107701dot-access through 1.0.0 contains a prototype pollution vuln…8.2
- CVE-2026-107702QloApps through 1.7.0 contains an authorization bypass vulne…4.3
- CVE-2026-107703@enmaso/node-convert through 1.0.0 contains an OS command in…9.8
- CVE-2026-107704The image_optimizer Ruby gem 1.3.0 through 1.9.0 contains an…9.8
- CVE-2026-107705Poppler 0.42.0 through 26.10.0 contains a stack-based buffer…6.5
- CVE-2026-107707Intego Antivirus for Windows through 3.0.0.1 contains a link…7.8
- CVE-2026-107708MIT krb5 through 1.22.2 contains a NULL pointer dereference …4.9
- CVE-2026-107709A path traversal vulnerability exists in Bower decompress-zi…7.8
- CVE-2026-10771A vulnerability was found in crmeb crmeb_java 1.4. Affected …7.3
- CVE-2026-10772Rejected reason: ** DUPLICATE ** This CVE Record has been re…
- CVE-2026-10773The DHCPv4 client helper net_dhcpv4_msg_type_name() in subsy…5.4
Are you affected by CVE-2026-107706?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST