{"id":"CVE-2020-12669","aliases":["GHSA-rg8m-84jf-9367"],"url":"https://o3.security/vulnerability/CVE-2020-12669","summary":"Incorrect Authorization in Dolibarr ","details":"core/get_menudiv.php in Dolibarr before 11.0.4 allows remote authenticated attackers to bypass intended access restrictions via a non-alphanumeric menu parameter.","published":"2020-05-06T19:15:12.707Z","modified":"2026-08-07T15:11:36.704479Z","cvss":{"score":8.8,"severity":"HIGH","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"},"epss":{"score":0.01955,"percentile":0.7849,"asOf":"2026-08-23"},"cisaKev":null,"exploitsKnown":0,"affectedPackages":[{"ecosystem":"Packagist","name":"dolibarr/dolibarr","fixedVersion":"12.0.0"}],"fix":{"url":"https://github.com/Dolibarr/dolibarr/commit/c1b530f58f6f01081ddbeaa2092ef308c3ec2727","label":"Dolibarr/dolibarr@c1b530f"},"references":[{"type":"ADVISORY","url":"https://sourceforge.net/projects/dolibarr/files/Dolibarr%20ERP-CRM/11.0.4/"},{"type":"FIX","url":"https://github.com/Dolibarr/dolibarr/commit/c1b530f58f6f01081ddbeaa2092ef308c3ec2727"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-08-07T15:11:36.704479Z"}}