CVE-2026-58376

Name of the Vulnerable Software and Affected Versions Dolibarr versions prior to 23.0.3

Description Authenticated API users can exfiltrate arbitrary database contents, including password hashes and API keys, via a SQL injection. The issue occurs when malicious values are supplied to the sqlfilters query parameter in the 'setup' and 'multicurrencies' REST API endpoints. The validation process in api setup.class.php and api multicurrencies.class.php only checks for balanced parentheses and rewrites matched triplets, which allows attackers to append a UNION SELECT statement to the SQL WHERE clause unmodified.

Recommendations Update to the version containing commit 14db36e. As a temporary mitigation, restrict access to the sqlfilters parameter in the 'setup' and 'multicurrencies' REST API endpoints.