HighVulnerabilityCVE-2026-33944updated 27 Oct 2026, 13:30 UTC

Dolibarr ERP/CRM: logged-in users can read the database via company edit form

A user with normal permission to edit company records can sneak database commands into the form and read hidden data, including admin password hashes. Attackers with a regular account could take over the system.

Official source

Severity	HighCVSS 8.8 of 10
Being exploited?	UnclearNo reports either way yet
Fix available?	UnclearNo fixed version published in the sources yet
How sure is this?	Official sourceBacked by an official source

How the attack works simplified

1Logged-in userHas Third Party edit permission
2Tampered POSTInjects SQL into lt1 parameter
3Unescaped queryValue concatenated into UPDATE statement
4Data exposedHashes and keys readable in notes
ResultAttacker reads the entire database

What happened

The localtax1_value (lt1) and localtax2_value (lt2) fields in the Third Party update code are concatenated directly into an SQL UPDATE statement without escaping or type casting, enabling SQL injection.

Why it is dangerous: An authenticated user with Third Party Create/Edit permission can extract any database data, including password hashes and API keys, exposing all business data.

Are you affected?

You are affected if you run Dolibarr ERP/CRM up to and including version 23.0.0 and have users with Third Party Create/Edit permission.

Package / product	Affected versions	Fixed in
dolibarr/dolibarr · composer	<= 23.0.0	no fix yet

What to do

Check the Dolibarr version and, if you run 23.0.0 or earlier, watch for an official fixed release
Restrict Third Party Create/Edit permissions to trusted users only until a fix is applied
Review user accounts and rotate admin passwords and API keys if untrusted users had this permission

Timeline

27 Oct 2026, 13:29 UTC
Publicly disclosed
27 Oct 2026, 13:29 UTC
Reported by GitHub Advisory · GitHub Advisory
27 Oct 2026, 13:30 UTC
Picked up by Zero Radar

Sources 1 report, oldest first

Official vendor, government CERT or advisory database

Dolibarr has SQL Injection in societe/class/societe.class.php via localtax1_value parameterGitHub Advisory · 27 Oct 2026, 13:29 UTC

Technical details

ID: CVE-2026-33944 · GHSA-v5fq-cf5m-vwv7
CVSS: 8.8 / 10
Disclosed: 27 Oct 2026, 13:29 UTC
On Zero Radar: 27 Oct 2026, 13:30 UTC (1 min after disclosure)
Last change: 27 Oct 2026, 13:30 UTC

The plain-language parts and the attack diagram were written by an AI model (anthropic/claude-haiku-5.5) from the sources above. Facts like versions, exploitation and dates come from the sources themselves. How Zero Radar works