# Dolibarr 16.0 - Security breach

**URL:** <https://www.dolibarr.org/forum/t/dolibarr-16-0-security-breach/23471>\
**Category:** Announcements & news\
**Tags:** vulnerability, v16\
**Created:** [March 16, 2023, 9:47am UTC](https://www.dolibarr.org/forum/t/dolibarr-16-0-security-breach/23471 "2023-03-16T09:47:10Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![ksar](https://www.dolibarr.org/forum/user_avatar/www.dolibarr.org/ksar/32/514_2.png) [@ksar](https://www.dolibarr.org/forum/u/ksar)\
**Post date:** [March 16, 2023, 9:47am UTC](https://www.dolibarr.org/forum/t/dolibarr-16-0-security-breach/23471/1 "2023-03-16T09:47:10Z")

</div>

Hello,  
an important security breach has been fixed in dolibarr 16 but as many people don’t necessarily follow all the updates I prefer to post a message in the hope that you can do the necessary on your installations.

First of all, only version 16 is impacted, version 15 (and before) are not and neither is version 17.

More precisely, it concerns the sub versions 16.0.0 16.0.1 16.0.2 16.0.3 and 16.0.4.

Please replace your htdocs/public/ticket/ajax/ajax.php file with this one:

> <https://github.com/Dolibarr/dolibarr/blob/5e49ed17d3ef858dff59cdc458624e3df52dd291/htdocs/public/ticket/ajax/ajax.php>

Description of the vulnerability and thanks to him: [Dolibarr : unauthenticated contacts database theft | DSecBypass](https://www.dsecbypass.com/en/dolibarr-pre-auth-contact-database-dump/)

To summarize, it is possible to extract your entire dolibarr contact database without even being authenticated…

Best regards,  
Erics  
(source : [Dolibarr 16.0 - Faille de sécurité - Maintenir mon Dolibarr - Forum Dolibarr france](https://www.dolibarr.fr/forum/t/dolibarr-16-0-faille-de-securite/42680))

---

<div class="post-metadata">

**Author:** ![ksar](https://www.dolibarr.org/forum/user_avatar/www.dolibarr.org/ksar/32/514_2.png) [@ksar](https://www.dolibarr.org/forum/u/ksar)\
**Post date:** [March 16, 2023, 9:47am UTC](https://www.dolibarr.org/forum/t/dolibarr-16-0-security-breach/23471/2 "2023-03-16T09:47:58Z")

</div>



---

<div class="post-metadata">

**Author:** ![playcock](https://www.dolibarr.org/forum/user_avatar/www.dolibarr.org/playcock/32/6009_2.png) [@playcock](https://www.dolibarr.org/forum/u/playcock)\
**Post date:** [March 24, 2023, 2:07pm UTC](https://www.dolibarr.org/forum/t/dolibarr-16-0-security-breach/23471/3 "2023-03-24T14:07:32Z")

</div>

@ksar  
I know that you have a thread that you update whenever a new Dolibarr version is released. What are your thoughts on creating a similar thread that covers whenever a security risk, such as this, is exposed? I would certainly subscribe to that thread.

---

<div class="post-metadata">

**Author:** ![ksar](https://www.dolibarr.org/forum/user_avatar/www.dolibarr.org/ksar/32/514_2.png) [@ksar](https://www.dolibarr.org/forum/u/ksar)\
**Post date:** [March 24, 2023, 7:58pm UTC](https://www.dolibarr.org/forum/t/dolibarr-16-0-security-breach/23471/4 "2023-03-24T19:58:23Z")

</div>

Hello @playcock,

Large topic…  
Currently, we have :

- [Github with CVE label](https://github.com/Dolibarr/dolibarr/labels/Bug%20Security%20%28CVE%29)
- [Official CVE repository](https://cve.mitre.org/cgi-bin/cvekey.cgi?keyword=dolibarr)
- [Security Advisories · Dolibarr/dolibarr · GitHub](https://github.com/Dolibarr/dolibarr/security/advisories) (But not populated for now)

Currently, @eldy and Dolibarr association is looking at how to better report/communicate on CVE.

I will keep you informed.

---

<div class="post-metadata">

**Author:** ![eldy](https://www.dolibarr.org/forum/user_avatar/www.dolibarr.org/eldy/32/12_2.png) [@eldy](https://www.dolibarr.org/forum/u/eldy)\
**Post date:** [March 29, 2023, 11:28am UTC](https://www.dolibarr.org/forum/t/dolibarr-16-0-security-breach/23471/5 "2023-03-29T11:28:32Z")

</div>

Currently the best solution seems to be an issue with the “CVE label”.