Reference page — cumulative record through Wednesday, August 19, 2026 UTC. Reference pages update as the archive grows; only dated daily editions are immutable pages of record.
AV AC AT PR UI VC VI VA CVSS EPSS %ile KEV N L N L N L L L 2.1 .0024 15.7 —
AFFECTED Product Versions Fixed Dolibarr 23.0.0 – —
TIMELINE Aug 15 EXPLOIT PUBLISHED — CVE-2026-19930 (Dolibarr). Public exploit reference added. Aug 15 Reserved by VulDB Aug 16 Published (CNA: VulDB) Aug 17 RESCORED — CVE-2026-19930 (Dolibarr). CVSS 5.3 → 2.1 (NVD).
A security flaw has been discovered in Dolibarr up to 23.0.3. Affected is an unknown function of the file htdocs/user/card.php of the component User Cloning. The manipulation of the argument ID results in ldap injection. It is possible to launch the attack remotely. The exploit has been released to the public and may be used for attacks. The patch is identified as 798e65356ede03c2812ab1a728f23fae34de5592. It is advisable to implement a patch to correct this issue.
| Date | Event | Detail |
|---|---|---|
| August 15, 2026 | EXPLOIT PUBLISHED | EXPLOIT PUBLISHED — CVE-2026-19930 (Dolibarr). Public exploit reference added. |
| August 15, 2026 | Reserved | Reserved by VulDB |
| August 16, 2026 | Published | Published (CNA: VulDB) |
| August 17, 2026 | RESCORED | RESCORED — CVE-2026-19930 (Dolibarr). CVSS 5.3 → 2.1 (NVD). |
| Vendor | Product / Package | Ecosystem | Version introduced | Fixed |
|---|---|---|---|---|
| n/a | Dolibarr | — | 23.0.0 | — |
Authoritative record: CVE-2026-19930 at cve.org
This is a reference page, not a dated page of record. It assembles the complete lifecycle of CVE-2026-19930 from the CVE Program record, NVD enrichment, the CISA KEV catalog, EPSS, and OSV advisories. The box score's numbers (CVSS, EPSS, KEV status) are current as of Wednesday, August 19, 2026 UTC and are re-derived as the archive grows; only dated daily editions are immutable pages of record. The authoritative source for this identifier is cve.org.