CVE-2026-10154

Executive Summary

CVE-2026-10154 is an authorization bypass vulnerability in Dolibarr ERP CRM, affecting versions 23.0.0, 23.0.1, and 23.0.2. The flaw resides in the htdocs/user/messaging.php file, where an attacker can manipulate the ID argument to bypass authorization checks. This allows an unauthenticated remote attacker to access or modify messaging functionality without proper permissions. The vulnerability has a CVSS score of 4.3 (Medium), indicating a moderate risk due to low attack complexity and no required privileges. The vendor has released a patch in version 23.0.3, and the specific commit is 119b3606c7a701747a57a1f18b1a9e7666f678e2.

Supply Chain & Package Security

This vulnerability affects the Dolibarr ERP CRM application, which is distributed as a PHP package. Organizations using Dolibarr should verify their version and apply the patch immediately. The supply chain risk is moderate, as the vulnerability is in a core component of the application.

CVSS Breakdown & Threat Level

• CVSS Score: 4.3 (Medium)
• Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
• Attack Vector: Network (AV:N)
• Attack Complexity: Low (AC:L)
• Privileges Required: None (PR:N)
• User Interaction: None (UI:N)
• Scope: Unchanged (S:U)
• Confidentiality Impact: Low (C:L)
• Integrity Impact: None (I:N)
• Availability Impact: None (A:N)

The threat level is Medium due to the low complexity and no required privileges, but the impact is limited to low confidentiality loss.

Deep Dive & Mechanics

The vulnerability is an authorization bypass in the htdocs/user/messaging.php file. The application fails to properly validate the ID parameter, allowing an attacker to access messaging functionality without proper authentication or authorization. The root cause is a missing or insufficient access control check on the ID parameter, which is used to identify the target user or message.

The attack is executed by sending a crafted HTTP request to the vulnerable endpoint with a manipulated ID value. This could allow an attacker to read, modify, or delete messages belonging to other users, depending on the specific implementation.

Vulnerable vs. Patched Code

The vulnerable code in versions 23.0.0 to 23.0.2 does not properly check if the current user has permission to access the messaging functionality for the given ID. The patched code in version 23.0.3 adds an authorization check to ensure the user is authenticated and has the necessary permissions.

Vulnerable Code (simplified):

// htdocs/user/messaging.php
$id = GETPOST('id', 'int');
// No authorization check
$message = getMessage($id);
echo $message;

Patched Code (simplified):

// htdocs/user/messaging.php
$id = GETPOST('id', 'int');
if (!isAuthenticated() || !hasPermission($id)) {
    accessDenied();
}
$message = getMessage($id);
echo $message;

Exploitation & Lab Setup

Red Team

To exploit this vulnerability, an attacker can send a crafted HTTP request to the vulnerable endpoint. The following example uses curl to access a message with a specific ID:

curl -v "http://target.com/htdocs/user/messaging.php?id=1"

If the request is successful, the attacker will receive the message content without authentication.

Blue Team

To detect exploitation attempts, monitor for unusual access to htdocs/user/messaging.php with varying id parameters. The following Suricata rule can detect such attempts:

alert http any any -> any any (msg:"CVE-2026-10154 - Dolibarr Authorization Bypass Attempt"; flow:to_server; content:"/htdocs/user/messaging.php"; http_uri; content:"id="; http_uri; classtype:attempted-recon; sid:1000001; rev:1;)

Indicators of Compromise (IOCs)

• File: htdocs/user/messaging.php
• URL Pattern: */htdocs/user/messaging.php?id=*
• Log Entry: Unauthorized access to htdocs/user/messaging.php with varying id parameters
• Network Traffic: HTTP requests to the vulnerable endpoint without authentication

Detection Engineering

YARA Rule

rule CVE_2026_10154_Dolibarr_Auth_Bypass {
    meta:
        description = "Detects Dolibarr authorization bypass vulnerability in htdocs/user/messaging.php"
        author = "Valters IT"
        date = "2026-01-01"
        reference = "CVE-2026-10154"
    strings:
        $vuln_file = "htdocs/user/messaging.php"
        $id_param = "id="
    condition:
        $vuln_file and $id_param
}

Sigma Rule

title: CVE-2026-10154 - Dolibarr Authorization Bypass
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects attempts to exploit CVE-2026-10154 in Dolibarr ERP CRM
author: Valters IT
date: 2026/01/01
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-uri-query|contains: "/htdocs/user/messaging.php?id="
    condition: selection
falsepositives:
    - Legitimate administrative access
level: medium

Suricata Rule

alert http any any -> any any (msg:"CVE-2026-10154 - Dolibarr Authorization Bypass Attempt"; flow:to_server; content:"/htdocs/user/messaging.php"; http_uri; content:"id="; http_uri; classtype:attempted-recon; sid:1000001; rev:1;)

Remediation & Mitigation

1. Upgrade Dolibarr: Upgrade to version 23.0.3 or later, which includes the fix.
2. Apply Patch: If upgrading is not immediately possible, apply the commit 119b3606c7a701747a57a1f18b1a9e7666f678e2 manually.
3. Web Application Firewall (WAF): Deploy WAF rules to block requests to htdocs/user/messaging.php with suspicious id parameters.
4. Access Control: Implement strict access controls and authentication checks for all sensitive endpoints.
5. Monitoring: Monitor logs for unauthorized access attempts to the vulnerable endpoint.

Valters IT
Securing Digital Frontiers