제출 #883067: dolibarr erp 18.0 User with Self-Edit Rights Can Write to Any Profile(Root + All )

Affected Component: User Notes (/user/perms.php, /user/note.php)
Vulnerability Type: Broken Access Control (IDOR)
Vulnerability severity: Meduim
Discovered by: Abderrahmane Aksoum

Description

A user possessing only the "Create/modify his own user information" permission can modify the public and private notes of all users, including administrators (root)
This is a pure broken access control flaw: the server fails to check that the id parameter in the note-editing function matches the currently logged-in user despite having zero permissions to modify other accounts the application allows this user to edit any profile including SuperAdmin

Impact

.Attacker with Create/modify his own user information permission can bypass security and tamper with internal admin notes because of the server fails to check that the id parameter in the note-editing function

.Can inject false information into admin-facing interfaces

.Full compromise of sensitive metadata integrity for all user levels

Remediation

Permanent: Add server-side authorization on note.php to enforce id == current user ID unless explicit "modify other users" permissions exist.

The Dolibarr maintainers confirmed the issue and applied a patch, with public credit given to the reporter in both the commit and the release catalog.

Fix commit https://github.com/Dolibarr/dolibarr/commit/32d74594be010d32664878521062235840257701
https://github.com/Dolibarr/dolibarr/pull/39077/changes/32d74594be010d32664878521062235840257701

vulnerability in github issues step by step:

https://github.com/Dolibarr/dolibarr/issues/39053

• 원천: ⚠️ https://github.com/Dolibarr/dolibarr/issues/39063
• 사용자: Abderrahmane Aksoum (UID 97571)
• 제출: 2026. 07. 08. PM 04:17 (2 개월 ago)
• 모더레이션: 2026. 08. 23. PM 01:44 (2 months later)
• 상태: 수락
• VulDB 항목: 394542 [Dolibarr ERP 까지 18.0.10/22.0.5/23.0.3 User Notes /user/note.php 아이디 권한 상승]
• 포인트들: 20