CVE-2021-3991: Dolibarr Erp/crm

Medium severity, CVSS 4.3. EPSS: 0.3% chance of exploitation in the next 30 days.

An Improper Authorization vulnerability exists in Dolibarr versions prior to the 'develop' branch. A user with restricted permissions in the 'Reception' section is able to access specific reception details via direct URL access, bypassing the intended permission restrictions.

Affected products

• Dolibarr Dolibarr Erp/crm: before 20.0.2 (fixed in 20.0.2)

Published 2024-11-15. Last modified 2026-06-17.