# CVE-2026-116218: Dolibarr ERP CRM SQL injection in company bank accounts API

Source: https://junglewise.ai/threats/cve-2026-116218-dolibarr-erp-crm-19-0-0-before-23-0-4-contains-an-sql-injection  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-26. Updated: 2026-10-26  
License: CC BY 4.0 with a link back

CVE-2026-116218 · Severity: high · CVSS 7.6 · Published 2026-10-26

Dolibarr is an open-source ERP and CRM system used to manage business operations, contacts, invoices, and accounting. An authenticated API user with limited permissions can inject malicious SQL commands through the company bank accounts REST endpoint to extract sensitive data like password hashes and API keys from the database. This requires valid credentials but allows attackers to escalate beyond their intended access level.

Technologies: [Dolibarr ERP CRM](https://junglewise.ai/threats/technologies/erp-crm). Vendors: [Dolibarr](https://junglewise.ai/threats/vendors/dolibarr).

## Quick answers

**Is CVE-2026-116218 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-116218 being exploited in the wild.

**How severe is CVE-2026-116218?** High severity, with a CVSS score of 7.6, published 26 October 2026.

**Which products and versions are affected?** Dolibarr ERP CRM 19.0.0 to 23.0.3.

**Is there a fix for CVE-2026-116218?** Yes: fixed in 23.0.4. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-116218 attacked?** It is attacked over the network.

**Am I affected by CVE-2026-116218?** Check whether you run Dolibarr ERP CRM at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in 23.0.4

## Technical details

An SQL injection vulnerability exists in the CompanyBankAccount::create() function within the REST API endpoint for third-party bank accounts, specifically in the unescaped type field. Authenticated users with only the societe/creer permission can exploit this via time-based blind SQL subqueries to read unauthorized data. The vulnerability is present in versions 19.0.0 through 23.0.3.

## Affected products

- Dolibarr ERP CRM 19.0.0 to 23.0.3

## Timeline

- 2026-10-26: disclosed

## References

- [https://github.com/Dolibarr/dolibarr](https://github.com/Dolibarr/dolibarr)
- [https://github.com/Dolibarr/dolibarr/blob/23.0.3/htdocs/societe/class/api_thirdparties.class.php](https://github.com/Dolibarr/dolibarr/blob/23.0.3/htdocs/societe/class/api_thirdparties.class.php)

## Related threats

- [Dolibarr ERP CRM missing authorization in recruitment module](https://junglewise.ai/threats/cve-2026-118754-dolibarr-erp-crm-before-24-0-2-contains-a-missing-authorization)
- [Dolibarr ERP CRM OS command injection in export.php](https://junglewise.ai/threats/cve-2026-116219-dolibarr-erp-crm-before-24-0-0-contains-an-os-command-injection)
- [Dolibarr ERP CRM authorization bypass in extrafield update](https://junglewise.ai/threats/cve-2026-107706-dolibarr-erp-crm-before-24-0-2-contains-an-incorrect)
- [Dolibarr ERP CRM improper authorization in Leave Request REST API](https://junglewise.ai/threats/cve-2026-10215-dolibarr-erp-crm-improper-authorization-in-leave-request-rest-api)
- [Dolibarr ERP CRM authorization bypass in messaging.php](https://junglewise.ai/threats/cve-2026-10154-dolibarr-erp-crm-authorization-bypass-in-messaging-php)