Dolibarr ERP CRM versions prior to 24.0.2 contain an incorrect authorization flaw in the updateextrafield.php API. The script only verifies that a user has read permission before accepting POST requests to write extrafield values, enabling read‑only users to persistently alter data attached to viewable third‑party entities, products, members, projects or contacts. This flaw allows an attacker with limited access to compromise data integrity by injecting or modifying extrafield data for authorized objects.

Dolibarr ERP CRM, vendor Dolibarr, product Dolibarr. All releases before version 24.0.2 are affected.

The CVSS score of 5.3 indicates moderate severity, and the EPSS score is not available, suggesting limited observation of exploitation activity. The vulnerability is not listed in the CISA KEV catalog. Exploitation requires an authenticated user with read‑only permissions who can send a crafted POST request to updateextrafield.php. The attack is local to the application layer and does not require elevated system privileges beyond those already granted to the user.