Unknown · Dolibarr Erp/Crm · CVE-2026-107706
**Name of the Vulnerable Software and Affected Versions**
Dolibarr ERP CRM versions prior to 24.0.2
**Description**
An incorrect authorization issue exists in the endpoint 'htdocs/core/ajax/updateextrafield.php'. The system only verifies read permissions before allowing the modification of extrafield values. Consequently, authenticated users with read-only access can send POST requests using the `objectType`, `objectId`, `field`, and `value` parameters to persistently modify extrafields of viewable third parties, products, members, projects, or contacts.
**Recommendations**
Update to version 24.0.2 or later.
As a temporary mitigation, restrict access to the 'htdocs/core/ajax/updateextrafield.php' endpoint for users with read-only permissions.