The vulnerability resides in the checkUserAccessToObject function within the Leave Request REST API (api_holidays.class.php) of Dolibarr ERP CRM. The flaw allows an attacker to bypass authorization controls and obtain data to which they should not have access. The issue is classified under CWE-266 and CWE-285, indicating a misconfiguration of privilege management. If exploited, the attacker could read or manipulate leave request information for users without proper clearance.

Dolibarr ERP CRM versions up to and including 23.0.1 are affected. The component is the Leave Request REST API, which relies on the api_holidays.class.php file. Upgrading to 23.0.2 or later resolves the issue, as the patch commit ee93b6f2f9dd0f6aeefe9d718ab3ab0a44326b73 has been applied.

The CVSS score of 5.3 places the vulnerability at a medium severity level. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog. The vulnerability can be triggered from a remote interface, and the exploit has been publicly disclosed, increasing the likelihood of real-world attacks. Given the remote nature and the public disclosure, administrators should treat this as a functional issue that could enable unauthorized data access.