CVE-2026-10215

MediumCVSS 4.3/10Last modified Jul 22, 2026

Description

A security vulnerability has been detected in Dolibarr ERP CRM up to 23.0.1. Impacted is the function checkUserAccessToObject of the file htdocs/holiday/class/api_holidays.class.php of the component Leave Request REST API. The manipulation leads to improper authorization. The attack may be initiated remotely. The exploit has been disclosed publicly and may be used. Upgrading to version 23.0.2 is recommended to address this issue. The identifier of the patch is ee93b6f2f9dd0f6aeefe9d718ab3ab0a44326b73. Upgrading the affected component is advised.

Metrics

CVSS 3.1 4.3/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Weakness enumeration

CWE-266 CWE-285

Affected software

No affected versions have been published.

Timeline

Published: Jun 1, 2026
Last modified: Jul 22, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-1021507.2A function in the Kiteworks Advanced Forms component was reachable without authentication. An unauthenticated attacker could potentially use CVE-2026-1021558.5An XML External Entity (XXE) injection vulnerability in the WiFi-server Spectralight application allows any authenticated user to send malic CVE-2026-1021566.8Improper neutralization of Lightweight Directory Access Protocol (LDAP) authentication input may allow an unauthenticated network attacker, CVE-2026-1021575.9An insecure direct object reference (IDOR) vulnerability in a CloudVision CUE file-serving interface may allow an authenticated network user CVE-2026-1021586.5Improper validation of selected CloudVision CUE application programming interface (API) request parameters may allow an authenticated networ CVE-2026-1021599.8An access-control flaw in the CV-CUE backend may allow an unauthenticated network attacker to access functionality intended only for interna CVE-2026-102163.7A vulnerability was detected in unitedbyai droidclaw up to 0.5.3. The affected element is an unknown function of the file server/src/routes/CVE-2026-1021607.2An operating system (OS) command injection vulnerability in CloudVision CUE backup management may allow an authenticated Super User to submi CVE-2026-1021618.8An unauthenticated attacker located on an adjacent private network (or any attacker routed through a reverse proxy/load balancer that forwar CVE-2026-1021628.8On affected Arista Wi-Fi access points with captive portal, or application firewall enabled on at least one SSID, a vulnerability in the wir CVE-2026-1021638.8On affected Arista access points with Wireless Intrusion Prevention System (WIPS) active, an unauthenticated attacker within radio frequency CVE-2026-1021643.1On affected Arista access points configured with VXLAN tunnelling and L2-proxy (a specific configuration unique to the VESPA use-case), a wi