CVE-2026-19930 in Dolibarr
Summary
by MITRE • 08/16/2026
A security flaw has been discovered in Dolibarr up to 23.0.3. Affected is an unknown function of the file htdocs/user/card.php of the component User Cloning. The manipulation of the argument ID results in ldap injection. It is possible to launch the attack remotely. The exploit has been released to the public and may be used for attacks. The patch is identified as 798e65356ede03c2812ab1a728f23fae34de5592. It is advisable to implement a patch to correct this issue.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 08/16/2026
This vulnerability resides within the Dolibarr ERP/CRM system, specifically in the user management component where the user cloning functionality is implemented. The flaw manifests in the htdocs/user/card.php file where an untrusted input parameter named ID is processed without adequate sanitization or validation. This represents a critical security oversight that allows attackers to inject malicious LDAP query components through the ID argument, potentially compromising the entire directory services integration that Dolibarr relies upon for user authentication and management.
The technical implementation of this vulnerability follows a classic LDAP injection pattern where user-supplied input directly influences LDAP search filters without proper escaping or parameterization. When an attacker manipulates the ID parameter in the URL, the application fails to sanitize the input before incorporating it into LDAP queries that are then executed against the underlying directory service. This allows for arbitrary LDAP query manipulation, potentially enabling unauthorized access to directory information, user enumeration, or even privilege escalation within the LDAP domain.
The operational impact of this vulnerability extends beyond simple data exposure, as it provides attackers with remote execution capabilities through the LDAP injection vector. The public availability of exploit code significantly increases the risk profile, as malicious actors can readily leverage this weakness without requiring advanced technical skills. Attackers could potentially extract sensitive user credentials, perform directory traversal attacks, or manipulate user accounts within the integrated LDAP environment, leading to complete compromise of user authentication systems.
The vulnerability maps directly to CWE-91 and CWE-77 in the Common Weakness Enumeration catalog, representing LDAP injection and improper neutralization of special elements used in a command. From an adversarial perspective, this flaw aligns with ATT&CK technique T1078 for valid accounts and T1566 for social engineering through credential exposure. The remote exploit capability means that attackers can target vulnerable systems from anywhere on the network without requiring physical access or prior authentication. Organizations running Dolibarr versions 23.0.3 or earlier should immediately implement the patch identified by commit hash 798e65356ede03c2812ab1a728f23fae34de5592, which properly sanitizes input parameters before LDAP query construction and implements proper parameter binding mechanisms to prevent injection attacks.