Is CVE-2026-116218 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-116218 being exploited in the wild.

How severe is CVE-2026-116218?

High severity, with a CVSS score of 7.6, published 26 October 2026.

Which products and versions are affected?

Dolibarr ERP CRM 19.0.0 to 23.0.3.

Is there a fix for CVE-2026-116218?

Yes: fixed in 23.0.4. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-116218 attacked?

It is attacked over the network.

Am I affected by CVE-2026-116218?

Check whether you run Dolibarr ERP CRM at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-116218: Dolibarr ERP CRM SQL injection in company bank accounts API

CVE-2026-116218 · Severity: high · CVSS 7.6 · Published 2026-10-26

Dolibarr is an open-source ERP and CRM system used to manage business operations, contacts, invoices, and accounting. An authenticated API user with limited permissions can inject malicious SQL commands through the company bank accounts REST endpoint to extract sensitive data like password hashes and API keys from the database. This requires valid credentials but allows attackers to escalate beyond their intended access level.

Technologies: Dolibarr ERP CRM. Vendors: Dolibarr.

Quick answers

Is CVE-2026-116218 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-116218 being exploited in the wild.
How severe is CVE-2026-116218?: High severity, with a CVSS score of 7.6, published 26 October 2026.
Which products and versions are affected?: Dolibarr ERP CRM 19.0.0 to 23.0.3.
Is there a fix for CVE-2026-116218?: Yes: fixed in 23.0.4. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-116218 attacked?: It is attacked over the network.
Am I affected by CVE-2026-116218?: Check whether you run Dolibarr ERP CRM at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: 23.0.4

Technical details

An SQL injection vulnerability exists in the CompanyBankAccount::create() function within the REST API endpoint for third-party bank accounts, specifically in the unescaped type field. Authenticated users with only the societe/creer permission can exploit this via time-based blind SQL subqueries to read unauthorized data. The vulnerability is present in versions 19.0.0 through 23.0.3.

Affected products

Dolibarr ERP CRM 19.0.0 to 23.0.3

Timeline

2026-10-26: disclosed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.