CVE-2026-7689mediumCWE-345CWE-347

CVE-2026-7689: medium-severity vulnerability in Dolibarr ERP CRM

Dolibarr ERP CRM Online Signature security.lib.php dol_verifyHash signature verification

Published · Updated

Follow this CVE+ Monitor ERP CRM+ Monitor dolibarr/dolibarr

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

33Vexday Risk Score

No sign of exploitation. It has a public proof of concept.

ssvc Attendcvss 6.3epss 0.1%
A security flaw has been discovered in Dolibarr ERP CRM up to 23.0.2. This vulnerability affects the function dol_verifyHash in the library htdocs/core/lib/security.lib.php of the component Online Signature Module. The manipulation results in improper verification of cryptographic signature. The attack may be performed from remote. Attacks of this nature are highly complex. It is stated that the exploitability is difficult. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P
Affected products
Dolibarr · ERP CRM
⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.
Related CVEs — Dolibarr ERP CRM

In the same product, most dangerous first.

CVE-2026-10215MEDIUMDolibarr ERP CRM Leave Request REST API api_holidays.class.php checkUserAccessToObject improper authorizationEPSS 0.3%CVE-2026-10154MEDIUMDolibarr ERP CRM messaging.php authorizationEPSS 0.2%CVE-2026-7688LOWDolibarr ERP CRM Shipments API Endpoint expedition.class.php _checkValForAPI sql injectionEPSS 0.2%CVE-2026-11619MEDIUMDolibarr ERP CRM Legacy Filemanager config.inc.php improper authorizationEPSS 0.2%