CVE-2026-7689: Dolibarr ERP CRM Insufficient Verification of Data Authenticity Vulnerability
Summary
CVE-2026-7689: Dolibarr has Insufficient Verification of Data Authenticity. Affects dolibarr/dolibarr versions < 15.0.3. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
Dolibarr is an open-source ERP and CRM software designed for small and medium businesses. It provides a range of functionalities including invoicing, project management, and customer relationship management. The software is modular, allowing users to enable only the features they need. However, versions up to 23.0.2 are affected by a significant security flaw that compromises the integrity of cryptographic signatures.
Vulnerability Detail
A security flaw has been identified in Dolibarr ERP CRM versions up to 23.0.2, specifically in the dol_verifyHash function located in htdocs/core/lib/security.lib.php within the Online Signature Module. This vulnerability arises from insufficient verification of cryptographic signatures, which could allow an attacker to manipulate data without detection. The complexity of exploiting this vulnerability is high, but the potential impact could lead to unauthorized access or data integrity issues. The exploit has been publicly released, increasing the urgency for users to address this issue.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary measure, users can limit access to the Online Signature Module until the software is updated. This can be done by modifying user permissions in the Dolibarr settings to restrict access to this feature.
Conclusion
The CVE-2026-7689 vulnerability in Dolibarr ERP CRM poses a significant risk due to insufficient verification of data authenticity. Users are strongly advised to update to the latest version to mitigate this risk. Temporary workarounds can be implemented, but a permanent fix is essential for maintaining data integrity.
See every vulnerability recorded for dolibarr/dolibarr →
FAQ
CVE-2026-7689 is a vulnerability in Dolibarr ERP CRM that involves insufficient verification of cryptographic signatures, potentially allowing data manipulation.
The vulnerability affects Dolibarr ERP CRM versions up to 23.0.2.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
If an immediate update is not possible, consider restricting access to the Online Signature Module as a temporary workaround.
The CVSS score for this vulnerability is 3.7, indicating a low severity level.
Related vulnerabilities
Recent vulnerabilities recorded for dolibarr/dolibarr.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
