Description

A weakness has been identified in Dolibarr up to 23.0.4. This affects an unknown part of the file htdocs/user/card.php of the component Account Handler. This manipulation of the argument ID causes improper authorization. The attack may be initiated remotely. The exploit has been made available to the public and could be used for attacks. Upgrading to version 24.0.0 is able to mitigate this issue. Patch name: b2a2c995537cb6282383b5e903cb5ffa29b823e6. The affected component should be upgraded.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.4",
  "pubDate": "2026-08-21T11:17:06.620Z",
  "pubdate": "2026-08-21T11:17:06.620Z",
  "executiveSummary": "An improper authorization vulnerability has been identified in Dolibarr up to version 23.0.4, specifically within the Account Handler component. This security flaw stems from insufficient access control checks regarding the manipulation of the ID argument within the htdocs/user/card.php file. Remote threat actors can exploit this weakness to bypass intended authorization boundaries, leading to unauthorized access to sensitive user account data and administrative control plane functionalities.\nThe risk implications are severe, as public exploits for this vulnerability have been made available, lowering the barrier to entry for malicious actors. Exploitation can be conducted remotely without requiring complex prerequisite conditions beyond network connectivity to the vulnerable Dolibarr instance. Successful attacks compromise the confidentiality and integrity of the affected system by allowing unauthorized manipulation of user records. Mitigation requires immediate administrative action to remediate the exposure through official vendor-supplied software updates.",
  "technicalDetails": "The vulnerability resides in the Account Handler component of Dolibarr, specifically within the htdocs/user/card.php script. The root cause of the flaw is improper authorization enforcement when processing user-supplied input via the ID argument. In a secure architecture, the application must cryptographically or logically verify that the authenticated session requesting the resource possesses the necessary administrative privileges or ownership context to access or modify the targeted user profile associated with the specified ID parameter.\nDue to the absence of adequate access validation logic, an attacker can supply arbitrary values to the ID argument to interact with user records outside their permission scope. The attack flow initiates with a remote attacker crafting an HTTP request directed at the htdocs/user/card.php endpoint. By manipulating the ID parameter within the request payload, the remote user bypasses authorization checks that normally restrict access to authorized roles. Network exposure is present as long as the Dolibarr instance is accessible via the web interface, and the availability of publicly accessible exploit code facilitates automated or manual enumeration and exploitation.\nThe post-exploitation impact includes unauthorized viewing and modification of user account cards, potential escalation of privileges, and manipulation of sensitive application metadata handled by the Account Handler component. The affected versions comprise all Dolibarr installations up to and including version 23.0.4. The vulnerability is addressed by applying the official patch referenced as b2a2c995537cb6282383b5e903cb5ffa29b823e6."
}