CVE-2026-11619

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-11619", "assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "state": "PUBLISHED", "assignerShortName": "VulDB", "dateReserved": "2026-06-08T20:12:59.884Z", "datePublished": "2026-06-09T02:30:12.759Z", "dateUpdated": "2026-06-09T14:50:39.911Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "shortName": "VulDB", "dateUpdated": "2026-06-09T02:30:12.759Z"}, "title": "Dolibarr ERP CRM Legacy Filemanager config.inc.php improper authorization", "problemTypes": [{"descriptions": [{"type": "CWE", "cweId": "CWE-285", "lang": "en", "description": "Improper Authorization"}]}, {"descriptions": [{"type": "CWE", "cweId": "CWE-266", "lang": "en", "description": "Incorrect Privilege Assignment"}]}], "affected": [{"vendor": "Dolibarr", "product": "ERP CRM", "versions": [{"version": "23.0.0", "status": "affected"}, {"version": "23.0.1", "status": "affected"}, {"version": "23.0.2", "status": "affected"}, {"version": "23.0.3", "status": "unaffected"}], "cpes": ["cpe:2.3:a:dolibarr:erp_crm:*:*:*:*:*:*:*:*"], "modules": ["Legacy Filemanager"]}], "descriptions": [{"lang": "en", "value": "A vulnerability was identified in Dolibarr ERP CRM up to 23.0.2. The impacted element is an unknown function of the file htdocs/core/filemanagerdol/connectors/php/config.inc.php of the component Legacy Filemanager. The manipulation leads to improper authorization. It is possible to initiate the attack remotely. The exploit is publicly available and might be used. Upgrading to version 23.0.3 is sufficient to resolve this issue. The identifier of the patch is f1b2dd6481e22cacb561d29ffdcd3a50b618479d. Upgrading the affected component is advised."}], "metrics": [{"cvssV4_0": {"version": "4.0", "baseScore": 5.3, "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P", "baseSeverity": "MEDIUM"}}, {"cvssV3_1": {"version": "3.1", "baseScore": 6.3, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C", "baseSeverity": "MEDIUM"}}, {"cvssV3_0": {"version": "3.0", "baseScore": 6.3, "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C", "baseSeverity": "MEDIUM"}}, {"cvssV2_0": {"version": "2.0", "baseScore": 6.5, "vectorString": "AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:OF/RC:C"}}], "timeline": [{"time": "2026-06-08T00:00:00.000Z", "lang": "en", "value": "Advisory disclosed"}, {"time": "2026-06-08T02:00:00.000Z", "lang": "en", "value": "VulDB entry created"}, {"time": "2026-06-08T22:18:03.000Z", "lang": "en", "value": "VulDB entry last update"}], "credits": [{"lang": "en", "value": "Abderrahmane Aksoum (VulDB User)", "type": "reporter"}], "references": [{"url": "https://vuldb.com/vuln/369300", "name": "VDB-369300 | Dolibarr ERP CRM Legacy Filemanager config.inc.php improper authorization", "tags": ["vdb-entry"]}, {"url": "https://vuldb.com/vuln/369300/cti", "name": "VDB-369300 | CTI Indicators (IOB, IOC, TTP, IOA)", "tags": ["signature", "permissions-required"]}, {"url": "https://vuldb.com/cve/CVE-2026-11619", "name": "CVE-2026-11619 | CVE Analysis and Report", "tags": ["third-party-advisory"]}, {"url": "https://vuldb.com/submit/834038", "name": "Submit #834038 | Dolibarr Dolibarr ERP/CRM up to 23.0.3 Missing Authorization", "tags": ["third-party-advisory"]}, {"url": "https://github.com/dolibarr/dolibarr/commit/f1b2dd6481e22cacb561d29ffdcd3a50b618479d", "tags": ["patch"]}, {"url": "https://github.com/Dolibarr/dolibarr/releases/tag/23.0.3", "tags": ["patch"]}], "tags": ["x_open-source"]}, "adp": [{"references": [{"url": "https://vuldb.com/submit/834038", "tags": ["exploit"]}], "metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-06-09T14:49:04.088148Z", "id": "CVE-2026-11619", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-06-09T14:50:39.911Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-11619", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-06-09T14:49:04.088148Z"}}}], "references": [{"url": "https://vuldb.com/submit/834038", "tags": ["exploit"]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-06-09T14:48:30.392Z"}}], "cna": {"tags": ["x_open-source"], "title": "Dolibarr ERP CRM Legacy Filemanager config.inc.php improper authorization", "credits": [{"lang": "en", "type": "reporter", "value": "Abderrahmane Aksoum (VulDB User)"}], "metrics": [{"cvssV4_0": {"version": "4.0", "baseScore": 5.3, "baseSeverity": "MEDIUM", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P"}}, {"cvssV3_1": {"version": "3.1", "baseScore": 6.3, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C"}}, {"cvssV3_0": {"version": "3.0", "baseScore": 6.3, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C"}}, {"cvssV2_0": {"version": "2.0", "baseScore": 6.5, "vectorString": "AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:OF/RC:C"}}], "affected": [{"cpes": ["cpe:2.3:a:dolibarr:erp_crm:*:*:*:*:*:*:*:*"], "vendor": "Dolibarr", "modules": ["Legacy Filemanager"], "product": "ERP CRM", "versions": [{"status": "affected", "version": "23.0.0"}, {"status": "affected", "version": "23.0.1"}, {"status": "affected", "version": "23.0.2"}, {"status": "unaffected", "version": "23.0.3"}]}], "timeline": [{"lang": "en", "time": "2026-06-08T00:00:00.000Z", "value": "Advisory disclosed"}, {"lang": "en", "time": "2026-06-08T02:00:00.000Z", "value": "VulDB entry created"}, {"lang": "en", "time": "2026-06-08T22:18:03.000Z", "value": "VulDB entry last update"}], "references": [{"url": "https://vuldb.com/vuln/369300", "name": "VDB-369300 | Dolibarr ERP CRM Legacy Filemanager config.inc.php improper authorization", "tags": ["vdb-entry"]}, {"url": "https://vuldb.com/vuln/369300/cti", "name": "VDB-369300 | CTI Indicators (IOB, IOC, TTP, IOA)", "tags": ["signature", "permissions-required"]}, {"url": "https://vuldb.com/cve/CVE-2026-11619", "name": "CVE-2026-11619 | CVE Analysis and Report", "tags": ["third-party-advisory"]}, {"url": "https://vuldb.com/submit/834038", "name": "Submit #834038 | Dolibarr Dolibarr ERP/CRM up to 23.0.3 Missing Authorization", "tags": ["third-party-advisory"]}, {"url": "https://github.com/dolibarr/dolibarr/commit/f1b2dd6481e22cacb561d29ffdcd3a50b618479d", "tags": ["patch"]}, {"url": "https://github.com/Dolibarr/dolibarr/releases/tag/23.0.3", "tags": ["patch"]}], "descriptions": [{"lang": "en", "value": "A vulnerability was identified in Dolibarr ERP CRM up to 23.0.2. The impacted element is an unknown function of the file htdocs/core/filemanagerdol/connectors/php/config.inc.php of the component Legacy Filemanager. The manipulation leads to improper authorization. It is possible to initiate the attack remotely. The exploit is publicly available and might be used. Upgrading to version 23.0.3 is sufficient to resolve this issue. The identifier of the patch is f1b2dd6481e22cacb561d29ffdcd3a50b618479d. Upgrading the affected component is advised."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-285", "description": "Improper Authorization"}]}, {"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-266", "description": "Incorrect Privilege Assignment"}]}], "providerMetadata": {"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "shortName": "VulDB", "dateUpdated": "2026-06-09T02:30:12.759Z"}}}, "cveMetadata": {"cveId": "CVE-2026-11619", "state": "PUBLISHED", "dateUpdated": "2026-06-09T14:50:39.911Z", "dateReserved": "2026-06-08T20:12:59.884Z", "assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "datePublished": "2026-06-09T02:30:12.759Z", "assignerShortName": "VulDB"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"cpes": ["cpe:2.3:a:dolibarr:erp_crm:*:*:*:*:*:*:*:*"], "modules": ["Legacy Filemanager"], "product": "ERP CRM", "vendor": "Dolibarr", "versions": [{"status": "affected", "version": "23.0.0"}, {"status": "affected", "version": "23.0.1"}, {"status": "affected", "version": "23.0.2"}, {"status": "unaffected", "version": "23.0.3"}]}], "source": "cna@vuldb.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "A vulnerability was identified in Dolibarr ERP CRM up to 23.0.2. The impacted element is an unknown function of the file htdocs/core/filemanagerdol/connectors/php/config.inc.php of the component Legacy Filemanager. The manipulation leads to improper authorization. It is possible to initiate the attack remotely. The exploit is publicly available and might be used. Upgrading to version 23.0.3 is sufficient to resolve this issue. The identifier of the patch is f1b2dd6481e22cacb561d29ffdcd3a50b618479d. Upgrading the affected component is advised."}, {"lang": "es", "value": "Una vulnerabilidad fue identificada en Dolibarr ERP CRM hasta la versi\u00f3n 23.0.2. El elemento afectado es una funci\u00f3n desconocida del archivo htdocs/core/filemanagerdol/connectors/PHP/config.inc.php del componente Legacy Filemanager. La manipulaci\u00f3n conduce a una autorizaci\u00f3n indebida. Es posible iniciar el ataque de forma remota. El exploit est\u00e1 disponible p\u00fablicamente y podr\u00eda ser utilizado. Actualizar a la versi\u00f3n 23.0.3 es suficiente para resolver este problema. El identificador del parche es f1b2dd6481e22cacb561d29ffdcd3a50b618479d. Se aconseja actualizar el componente afectado."}], "id": "CVE-2026-11619", "lastModified": "2026-07-23T08:10:00.137", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "MEDIUM", "cvssData": {"accessComplexity": "LOW", "accessVector": "NETWORK", "authentication": "SINGLE", "availabilityImpact": "PARTIAL", "baseScore": 6.5, "confidentialityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "vectorString": "AV:N/AC:L/Au:S/C:P/I:P/A:P", "version": "2.0"}, "exploitabilityScore": 8.0, "impactScore": 6.4, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "cna@vuldb.com", "type": "Secondary", "userInteractionRequired": false}], "cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 6.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 3.4, "source": "cna@vuldb.com", "type": "Secondary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 2.1, "baseSeverity": "LOW", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "PROOF_OF_CONCEPT", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "LOW", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "LOW", "vulnConfidentialityImpact": "LOW", "vulnIntegrityImpact": "LOW", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "cna@vuldb.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-11619", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-06-09T14:49:04.088148Z", "version": "2.0.3"}}]}, "published": "2026-06-09T03:16:25.877", "references": [{"source": "cna@vuldb.com", "url": "https://github.com/Dolibarr/dolibarr/releases/tag/23.0.3"}, {"source": "cna@vuldb.com", "url": "https://github.com/dolibarr/dolibarr/commit/f1b2dd6481e22cacb561d29ffdcd3a50b618479d"}, {"source": "cna@vuldb.com", "url": "https://vuldb.com/cve/CVE-2026-11619"}, {"source": "cna@vuldb.com", "url": "https://vuldb.com/submit/834038"}, {"source": "cna@vuldb.com", "url": "https://vuldb.com/vuln/369300"}, {"source": "cna@vuldb.com", "url": "https://vuldb.com/vuln/369300/cti"}, {"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "url": "https://vuldb.com/submit/834038"}], "sourceIdentifier": "cna@vuldb.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-266"}, {"lang": "en", "value": "CWE-285"}], "source": "cna@vuldb.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "23.0.0"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "23.0.1"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "23.0.2"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "23.0.3"}}], "enrichment": {"confidence": 95.0, "confidence_source": "inferred", "scores": [{"score": 95.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "ERP CRM", "source": "cna", "vendor": "Dolibarr"}, "product": "erp_crm", "vendor": "dolibarr"}], "created": "2026-06-09T04:30:42.496964+00:00", "updated": "2026-06-09T04:30:42.786546+00:00", "vendors": ["dolibarr", "dolibarr$PRODUCT$erp_crm"]}