{"id":"CVE-2026-116218","aliases":["EUVD-2026-109810","GHSA-m4jj-h65f-p4xj","UBUNTU-CVE-2026-116218"],"status":"published","title":"Dolibarr ERP CRM 19.0.0 before 23.0.4 SQL Injection via bankaccounts API type field","description":"Dolibarr ERP CRM 19.0.0 before 23.0.4 contains an SQL injection vulnerability that allows authenticated API users to inject SQL via the type field of the third-party bankaccounts REST endpoint. Attackers with only societe/creer permission can break out of the unescaped type value in CompanyBankAccount::create() to read password hashes and API keys via time-based blind subqueries.","severity":{"version":"4.0","score":7.2,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:L/SC:N/SI:N/SA:N","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-12","score":0.00271,"percentile":0.19723,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-89"],"published":"2026-10-26T13:08:49Z","modified":"2026-11-05T17:04:37Z","affected":[{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"dolibarr","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.5.5+dfsg1-2","3.5.7+dfsg1-1","3.5.8+dfsg1-1","3.5.8+dfsg1-1ubuntu1","3.5.8+dfsg1-1ubuntu1+esm1"]}],"products":[{"vendor":"dolibarr","product":"dolibarr"}],"references":[{"url":"https://github.com/Dolibarr/dolibarr/commit/19991c8ffa9b4fd7338b7ef2585fadb554b86735","tags":["patch","fix"]},{"url":"https://github.com/Dolibarr/dolibarr/blob/23.0.3/htdocs/societe/class/companybankaccount.class.php#L399","tags":["technical-description","article"]},{"url":"https://github.com/Dolibarr/dolibarr/blob/23.0.3/htdocs/societe/class/api_thirdparties.class.php#L1852","tags":["technical-description","article"]},{"url":"https://github.com/Dolibarr/dolibarr","tags":["product","package"]},{"url":"https://www.vulncheck.com/advisories/dolibarr-erp-crm-19.0.0-before-23.0.4-sql-injection-via-bankaccounts-api-type-field","tags":["third-party-advisory","advisory","report"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-116218","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-m4jj-h65f-p4xj"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/116xxx/CVE-2026-116218.json","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2026-116218","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-116218","tags":["report"]},{"url":"https://github.com/cveproject/cvelistv5/tree/main/cves/2026/116xxx/cve-2026-116218.json","tags":["report"]},{"url":"https://github.com/dolibarr/dolibarr","tags":["report"]},{"url":"https://github.com/dolibarr/dolibarr/blob/23.0.3/htdocs/societe/class/api_thirdparties.class.php#l1852","tags":["report"]},{"url":"https://github.com/dolibarr/dolibarr/blob/23.0.3/htdocs/societe/class/companybankaccount.class.php#l399","tags":["report"]},{"url":"https://github.com/dolibarr/dolibarr/commit/19991c8ffa9b4fd7338b7ef2585fadb554b86735","tags":["report"]},{"url":"https://nvd.nist.gov/vuln/detail/cve-2026-116218","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2026-116218","title":"Dolibarr ERP CRM 19.0.0 before 23.0.4 SQL Injection via bankaccounts API type field","description":"Dolibarr ERP CRM 19.0.0 before 23.0.4 contains an SQL injection vulnerability that allows authenticated API users to inject SQL via the type field of the third-party bankaccounts REST endpoint. Attackers with only societe/creer permission can break out of the unescaped type value in CompanyBankAccount::create() to read password hashes and API keys via time-based blind subqueries.","status":"published","published":"2026-10-26T13:08:49.982Z","modified":"2026-11-05T17:04:37.486Z","cvss":[{"version":"4.0","score":7.2,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:L/SC:N/SI:N/SA:N","level":"high","assessor":"cna"},{"version":"3.1","score":7.6,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L","level":"high","assessor":"cna"}],"cwes":["CWE-89"],"updated_at":"2026-11-05T18:54:20.702128Z"}],"euvd":[{"id":"EUVD-2026-109810","description":"Dolibarr ERP CRM 19.0.0 before 23.0.4 contains an SQL injection vulnerability that allows authenticated API users to inject SQL via the type field of the third-party bankaccounts REST endpoint. Attackers with only societe/creer permission can break out of the unescaped type value in CompanyBankAccount::create() to read password hashes and API keys via time-based blind subqueries.","status":"published","published":"2026-10-26T13:08:49Z","modified":"2026-11-05T17:04:37Z","cvss":[{"version":"4.0","score":7.2,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:L/SC:N/SI:N/SA:N","level":"high"}],"updated_at":"2026-11-05T18:00:57.218327Z"}],"ghsa":[{"id":"GHSA-m4jj-h65f-p4xj","title":"Dolibarr ERP CRM 19.0.0 before 23.0.4 contains an SQL injection vulnerability that allows...","description":"Dolibarr ERP CRM 19.0.0 before 23.0.4 contains an SQL injection vulnerability that allows authenticated API users to inject SQL via the type field of the third-party bankaccounts REST endpoint. Attackers with only societe/creer permission can break out of the unescaped type value in CompanyBankAccount::create() to read password hashes and API keys via time-based blind subqueries.","status":"published","published":"2026-10-26T15:34:43Z","modified":"2026-10-26T15:34:48Z","cvss":[{"version":"4.0","score":7.2,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"high"},{"version":"3.1","score":7.6,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L","level":"high"}],"cwes":["CWE-89"],"updated_at":"2026-11-02T15:14:23.996006Z"}],"nvd":[{"id":"CVE-2026-116218","description":"Dolibarr ERP CRM 19.0.0 before 23.0.4 contains an SQL injection vulnerability that allows authenticated API users to inject SQL via the type field of the third-party bankaccounts REST endpoint. Attackers with only societe/creer permission can break out of the unescaped type value in CompanyBankAccount::create() to read password hashes and API keys via time-based blind subqueries.","status":"published","published":"2026-10-26T14:16:34.823Z","modified":"2026-11-05T17:17:43.48Z","cvss":[{"version":"4.0","score":7.2,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"high","assessor":"secondary"},{"version":"3.1","score":7.6,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L","level":"high","assessor":"secondary"}],"cwes":["CWE-89"],"updated_at":"2026-11-05T19:56:06.953289Z"}],"osv":[{"id":"CVE-2026-116218","title":"Dolibarr ERP CRM 19.0.0 before 23.0.4 SQL Injection via bankaccounts API type field","description":"Dolibarr ERP CRM 19.0.0 before 23.0.4 contains an SQL injection vulnerability that allows authenticated API users to inject SQL via the type field of the third-party bankaccounts REST endpoint. Attackers with only societe/creer permission can break out of the unescaped type value in CompanyBankAccount::create() to read password hashes and API keys via time-based blind subqueries.","status":"published","published":"2026-10-26T13:08:49.982Z","modified":"2026-11-07T02:30:35.349146438Z","cvss":[{"version":"4.0","score":7.2,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:L/SC:N/SI:N/SA:N","level":"high"}],"cwes":["CWE-89"],"updated_at":"2026-11-07T03:08:01.156605Z"},{"id":"UBUNTU-CVE-2026-116218","description":"Dolibarr ERP CRM 19.0.0 before 23.0.4 contains an SQL injection vulnerability that allows authenticated API users to inject SQL via the type field of the third-party bankaccounts REST endpoint. Attackers with only societe/creer permission can break out of the unescaped type value in CompanyBankAccount::create() to read password hashes and API keys via time-based blind subqueries.","status":"published","published":"2026-10-26T14:16:00Z","modified":"2026-10-28T20:18:18.601120905Z","cvss":[{"version":"3.1","score":7.6,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L","level":"high"},{"version":"3.1","score":7.6,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L","level":"high"},{"version":"4.0","score":7.2,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:L/SC:N/SI:N/SA:N","level":"high"},{"version":"4.0","score":7.2,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:L/SC:N/SI:N/SA:N","level":"high"}],"updated_at":"2026-11-02T16:56:00.081948Z"}]}}