Miggo at BlackHat 2026!
Easily map the attack path and prioritize which CVEs are a threat to your organization
Miggo AIGenerate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| dolibarr/dolibarr | composer | <= 15.0.3 |
Miggo AIRoot Cause AnalysisThe vulnerability lies in the REST API endpoints for managing leave requests (htdocs/holiday/class/api_holidays.class.php). Multiple methods in the Holidays class were performing an improper authorization check. Specifically, they called the DolibarrApi::_checkAccessToResource function, providing only the resource ID (e.g., $this->holiday->id). This was insufficient for _checkAccessToResource to determine if the currently authenticated user had the right to access the requested resource. The patch (ee93b6f2f9dd0f6aeefe9d718ab3ab0a44326b73) rectifies this by passing the entire object (e.g., $this->holiday) to the access check function. This provides the necessary context, such as object ownership, for a correct authorization decision. The same vulnerability pattern was also present and fixed in the expense reports API (htdocs/expensereport/class/api_expensereports.class.php). An attacker could have exploited this by making an API call with the ID of a leave request belonging to another user, allowing them to view or modify it without proper authorization.
Holidays.gethtdocs/holiday/class/api_holidays.class.php
Holidays.puthtdocs/holiday/class/api_holidays.class.php
Holidays.deletehtdocs/holiday/class/api_holidays.class.php
Holidays.validatehtdocs/holiday/class/api_holidays.class.php
Holidays.approvehtdocs/holiday/class/api_holidays.class.php
Holidays.cancelhtdocs/holiday/class/api_holidays.class.php
Holidays.refusehtdocs/holiday/class/api_holidays.class.php
Holidays.reopenhtdocs/holiday/class/api_holidays.class.php