CVE-2026-10215
1 advisory.
Packagist/dolibarr/dolibarr CVE-2026-10215: medium 4.3
Dolibarr ERP CRM is vulnerable to Improper Authorization through its Leave Request REST API
Action: No fix published. Pin and monitor.
Affected
| introduced | fixed | last affected |
|---|---|---|
| 0 | - | 15.0.3 |
Fixed versions
No fixed version in the source.
Sources
- osv: GHSA-7fg5-vc77-69fp
- https://nvd.nist.gov/vuln/detail/CVE-2026-10215
- https://github.com/Dolibarr/dolibarr/issues/37752
- https://github.com/Dolibarr/dolibarr/issues/37752#issuecomment-4304055921
- https://github.com/Dolibarr/dolibarr/commit/ee93b6f2f9dd0f6aeefe9d718ab3ab0a44326b73
- https://github.com/Dolibarr/dolibarr
- https://github.com/Dolibarr/dolibarr/releases/tag/23.0.2
- https://github.com/user-attachments/files/26487388/2_Dolibarr_Leave_Request_API_Horizontal_Unauthorized_Read_en.pdf
- https://vuldb.com/cve/CVE-2026-10215
- https://vuldb.com/submit/821930
- https://vuldb.com/vuln/367494
- https://vuldb.com/vuln/367494/cti
CVE-2026-10215 · published · modified · JSON