Is CVE-2026-107706 being exploited?

No public exploit is currently tracked.

How severe is CVE-2026-107706?

CVE-2026-107706 has a CVSS v3 severity of MEDIUM (4.3).

Back

CVE-2026-107706

Description

Dolibarr ERP CRM before 24.0.2 contains an incorrect authorization vulnerability in htdocs/core/ajax/updateextrafield.php that checks only read permission before writing extrafield values. Authenticated users with read-only access can POST objectType, objectId, field and value parameters to persistently modify extrafields on viewable third parties, products, members, projects or contacts.