# Dolibarr 16.0 - Security breach

**URL:** <https://www.dolibarr.org/forum/t/dolibarr-16-0-security-breach/23471>\
**Category:** Announcements & news\
**Tags:** vulnerability, v16\
**Created:** [March 16, 2023, 9:47am UTC](https://www.dolibarr.org/forum/t/dolibarr-16-0-security-breach/23471 "2023-03-16T09:47:10Z")\
**Posts on this page:** 1\
**Showing post:** 1

<div class="post-metadata">

**Author:** ![ksar](https://www.dolibarr.org/forum/user_avatar/www.dolibarr.org/ksar/32/514_2.png) [@ksar](https://www.dolibarr.org/forum/u/ksar)\
**Post date:** [March 16, 2023, 9:47am UTC](https://www.dolibarr.org/forum/t/dolibarr-16-0-security-breach/23471/1 "2023-03-16T09:47:10Z")

</div>

Hello,  
an important security breach has been fixed in dolibarr 16 but as many people don’t necessarily follow all the updates I prefer to post a message in the hope that you can do the necessary on your installations.

First of all, only version 16 is impacted, version 15 (and before) are not and neither is version 17.

More precisely, it concerns the sub versions 16.0.0 16.0.1 16.0.2 16.0.3 and 16.0.4.

Please replace your htdocs/public/ticket/ajax/ajax.php file with this one:

> <https://github.com/Dolibarr/dolibarr/blob/5e49ed17d3ef858dff59cdc458624e3df52dd291/htdocs/public/ticket/ajax/ajax.php>

Description of the vulnerability and thanks to him: [Dolibarr : unauthenticated contacts database theft | DSecBypass](https://www.dsecbypass.com/en/dolibarr-pre-auth-contact-database-dump/)

To summarize, it is possible to extract your entire dolibarr contact database without even being authenticated…

Best regards,  
Erics  
(source : [Dolibarr 16.0 - Faille de sécurité - Maintenir mon Dolibarr - Forum Dolibarr france](https://www.dolibarr.fr/forum/t/dolibarr-16-0-faille-de-securite/42680))

---

_[View the full topic](https://www.dolibarr.org/forum/t/dolibarr-16-0-security-breach/23471)._