CVE-2026-107706

Name of the Vulnerable Software and Affected Versions Dolibarr ERP CRM versions prior to 24.0.2

Description An incorrect authorization issue exists in the endpoint 'htdocs/core/ajax/updateextrafield.php'. The system only verifies read permissions before allowing the modification of extrafield values. Consequently, authenticated users with read-only access can send POST requests using the objectType, objectId, field, and value parameters to persistently modify extrafields of viewable third parties, products, members, projects, or contacts.

Recommendations Update to version 24.0.2 or later. As a temporary mitigation, restrict access to the 'htdocs/core/ajax/updateextrafield.php' endpoint for users with read-only permissions.