The vulnerability exists in the Legacy Filemanager component of Dolibarr ERP CRM in an unknown function of config.inc.php, allowing an attacker to bypass proper authorization checks. The misuse leads to improper authorization, potentially granting unauthorized users privileges of higher role. An attacker could perform actions normally restricted to administrators, such as creating, editing, or deleting records, which could compromise data integrity and confidentiality.

Dolibarr ERP CRM versions up to 23.0.2 are affected. The issue is resolved in version 23.0.3, which contains the commit f1b2dd6481e22cacb561d29ffdcd3a50b618479d. All installations using the legacy file manager module and the mentioned file path are impacted.

The CVSS score of 5.3 indicates a moderate severity; the EPSS score is not available, and it is not listed in CISA KEV. The exploit is publicly available, and the description states that it can be initiated remotely, implying that an attacker who can access the web interface can exploit the flaw. The moderate severity suggests a meaningful risk, especially in environments with unrestricted access to the file manager.