CVE-2026-77686 in Dolibarr
Summary
by MITRE • 08/21/2026
A weakness has been identified in Dolibarr up to 23.0.4. This affects an unknown part of the file htdocs/user/card.php of the component Account Handler. This manipulation of the argument ID causes improper authorization. The attack may be initiated remotely. The exploit has been made available to the public and could be used for attacks. Upgrading to version 24.0.0 is able to mitigate this issue. Patch name: b2a2c995537cb6282383b5e903cb5ffa29b823e6. The affected component should be upgraded.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 08/21/2026
The identified vulnerability resides within the Dolibarr open-source ERP and CRM software, specifically affecting versions up to 23.0.4 in the file htdocs/user/card.php which is part of the Account Handler component. This flaw represents a critical failure in access control mechanisms where the application fails to properly validate whether an authenticated user has sufficient privileges to perform actions on specific resources based on the provided identifier arguments. The core technical issue stems from improper authorization logic, allowing attackers who have valid credentials or can manipulate session contexts to bypass intended security restrictions. By manipulating the ID argument passed to this script, an attacker can potentially access, modify, or delete data belonging to other users or administrative accounts that they should not be authorized to interact with. This type of vulnerability is classically categorized under CWE-269 Improper Privilege Management and often aligns with MITRE ATT&CK techniques related to privilege escalation such as T1078 Valid Accounts if the attacker starts with low-level credentials, or potentially T1548 Abuse Elevation Control Mechanism depending on how the bypass is executed.
The operational impact of this vulnerability is significant because it enables remote exploitation without requiring physical access or complex local conditions. Since the exploit has been made publicly available, automated scanning tools and malicious actors can readily leverage this weakness to compromise system integrity. An attacker could use this flaw to escalate their privileges from a standard user role to an administrative level, thereby gaining full control over the Dolibarr instance. This could lead to unauthorized access to sensitive business data including customer information, financial records, and internal communications stored within the ERP/CRM database. Furthermore, if combined with other vulnerabilities such as SQL injection or cross-site scripting that might exist in adjacent modules, the scope of damage expands considerably, potentially allowing for complete system compromise and persistent backdoor installation.
Mitigation strategies primarily focus on immediate patching to eliminate the root cause of the authorization bypass. Upgrading Dolibarr to version 24.0.0 is confirmed to resolve this specific issue by implementing corrected access control checks within the Account Handler component. The provided patch identifier b2a2c995537cb6282383b5e903cb5ffa29b823e6 contains the necessary code changes to enforce proper validation of user permissions before processing requests related to account management tasks. Organizations running affected versions should prioritize this upgrade in their maintenance windows to restore secure operational boundaries. In addition to patching, it is advisable to review access logs for any signs of exploitation attempts using known exploit patterns associated with ID manipulation in the card.php endpoint. Implementing Web Application Firewall rules that detect anomalous request structures targeting user management endpoints can provide an additional layer of defense while migration efforts are underway. Regular security audits and adherence to secure coding standards such as OWASP Top 10 guidelines will help prevent similar authorization flaws from being introduced into future releases or custom modules within the Dolibarr ecosystem.