An authenticated API user can inject unsanitized SQL through the 'type' field of the third‑party bank accounts endpoint. The injection occurs in CompanyBankAccount::create() and allows an attacker to perform time‑based blind subqueries that expose password hashes and API keys. This flaw provides attackers with the ability to obtain sensitive authentication credentials from the database, compromising confidentiality of user accounts.

Dolibarr ERP CRM versions 19.0.0 up to, but not including, 23.0.4 are affected. Users running any of these releases should review the critical update that addresses the SQL injection. The vulnerability appears in the bank accounts REST API and requires the user to have societe/creer permissions, which most API consumers granted for external integrations.

The CVSS score of 7.2 indicates a high exploitation severity. The EPSS score is not available, so the current probability of exploitation cannot be quantified, and the vulnerability is not in the CISA KEV list. Attackers must first authenticate with a Dolibarr API user that has the societe/creer role and then supply a crafted 'type' value to trigger the injection. Once the injection succeeds, an attacker can read stored password hashes and API keys, potentially enabling account takeover or broader system compromise.