GitHub Advisoryadvisory · Packagist

GHSA-jggh-5rmh-r6h5 Dolibarr has Insufficient Verification of Data Authenticity

LOW Published 2026-05-03 Modified 2026-05-07 Official page ↗
Aliases
CVE-2026-7689
Ecosystem
Packagist
Packages
dolibarr/dolibarr
Severity
Low
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N
Weaknesses
CWE-345
Reviewed
2026-05-07

Affected packages

• Packagist dolibarr/dolibarr: <= 15.0.3 (no fix yet)

Description

A security flaw has been discovered in Dolibarr ERP CRM up to 23.0.2. This vulnerability affects the function dol_verifyHash in the library htdocs/core/lib/security.lib.php of the component Online Signature Module. The manipulation results in improper verification of cryptographic signature. The attack may be performed from remote. Attacks of this nature are highly complex. It is stated that the exploitability is difficult. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.

Related

Alias · CVE (1)

  • CVE-2026-7689 A security flaw has been discovered in Dolibarr ERP CRM up to 23.0.2. vulnerability

Weakness · CWE (1)

  • CWE-345 Insufficient Verification of Data Authenticity weakness

References