CVE-2021-25954

🗓️ 09 Aug 2021 16:58:31Reported by MendType

cve🔗 web.nvd.nist.gov👁 105 Views🌐 WEB

Insecure access restriction in Dolibarr applicatio

Reporter	Title	Published	Views	Family All 16
attackerkb	CVE-2021-25954	6 Aug 202121:00	–	attackerkb
BDU FSTEC	Dolibarr Access Control Data Compromise	10 Sep 202100:00	–	bdu_fstec
Circl	CVE-2021-25954	9 Aug 202120:37	–	circl
CNNVD	Dolibarr ERP/CRM 访问控制错误漏洞	9 Aug 202100:00	–	cnnvd
Cvelist	CVE-2021-25954 Improper Access Control in “Dolibarr”	9 Aug 202116:58	–	cvelist
EUVD	EUVD-2021-1905	7 Oct 202500:30	–	euvd
Github Security Blog	Improper Access Control in Dolibarr	11 Aug 202115:18	–	github
Mend	CVE-2021-25954	9 Aug 202116:58	–	mend
NVD	CVE-2021-25954	9 Aug 202117:15	–	nvd
osv_ghsa	GHSA-VXHC-C4QM-647P Improper Access Control in Dolibarr	11 Aug 202115:18	–	osv_ghsa

NVD

Node

dolibarr dolibarrRange2.8.1–13.0.4

[
  {
    "product": "dolibarr",
    "vendor": "Dolibarr",
    "versions": [
      {
        "lessThan": "unspecified",
        "status": "affected",
        "version": "2.8.1",
        "versionType": "custom"
      },
      {
        "lessThanOrEqual": "13.0.4",
        "status": "affected",
        "version": "unspecified",
        "versionType": "custom"
      }
    ]
  }
]

Source	Link
whitesourcesoftware	www.whitesourcesoftware.com/vulnerability-database/CVE-2021-25954
github	www.github.com/Dolibarr/dolibarr/commit/8cc100012d46282799fb19f735a53b7101569377

Parameter	Position	Path	Description	CWE
note	request body	/adherents/note.php?id=1	Dolibarr vulnerability allows a low-privilege user to modify a Private Note via /adherents/note.php?id=1 due to improper access control (CWE-284, CWE-863).	CWE-284, CWE-863

17 Jun 2026 03:42Current

4.3Medium risk

Vulners AI Score4.3

CVSS 24

CVSS 3.14.3

EPSS0.00702