Cross Site Request Forgery vulnerability in Dolibarr ERP & CRM v.22.0.9 allows a remote attacker to escalate privileges via the notes field in perms.php NOTE: this is disputed by a third party who indicates that exploitation can only occur if an unprivileged user knows the token of an admin user.
References
Configurations
No configuration.
History
14 Feb 2026, 05:16
| Type | Values Removed | Values Added |
|---|---|---|
| Summary | (en) Cross Site Request Forgery vulnerability in Dolibarr ERP & CRM v.22.0.9 allows a remote attacker to escalate privileges via the notes field in perms.php NOTE: this is disputed by a third party who indicates that exploitation can only occur if an unprivileged user knows the token of an admin user. |
12 Feb 2026, 16:16
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2026-02-12 16:16
Updated : 2026-02-14 05:16
NVD link : CVE-2025-69634
Mitre link : CVE-2025-69634
CVE.ORG link : CVE-2025-69634
JSON object : View
Products Affected
No product.