Submeter #883067: dolibarr erp 18.0 User with Self-Edit Rights Can Write to Any Profile(Root + All )

Affected Component: User Notes (/user/perms.php, /user/note.php)
Vulnerability Type: Broken Access Control (IDOR)
Vulnerability severity: Meduim
Discovered by: Abderrahmane Aksoum

Description

A user possessing only the "Create/modify his own user information" permission can modify the public and private notes of all users, including administrators (root)
This is a pure broken access control flaw: the server fails to check that the id parameter in the note-editing function matches the currently logged-in user despite having zero permissions to modify other accounts the application allows this user to edit any profile including SuperAdmin

Impact

.Attacker with Create/modify his own user information permission can bypass security and tamper with internal admin notes because of the server fails to check that the id parameter in the note-editing function

.Can inject false information into admin-facing interfaces

.Full compromise of sensitive metadata integrity for all user levels

Remediation

Permanent: Add server-side authorization on note.php to enforce id == current user ID unless explicit "modify other users" permissions exist.

The Dolibarr maintainers confirmed the issue and applied a patch, with public credit given to the reporter in both the commit and the release catalog.

Fix commit https://github.com/Dolibarr/dolibarr/commit/32d74594be010d32664878521062235840257701
https://github.com/Dolibarr/dolibarr/pull/39077/changes/32d74594be010d32664878521062235840257701

vulnerability in github issues step by step:

https://github.com/Dolibarr/dolibarr/issues/39053

• Fonte: ⚠️ https://github.com/Dolibarr/dolibarr/issues/39063
• Utilizador: Abderrahmane Aksoum (UID 97571)
• Submissão: 08/07/2026 16h17 (há 2 meses)
• Moderação: 23/08/2026 13h44 (2 months later)
• Estado: Aceite
• Entrada VulDB: 394542 [Dolibarr ERP até 18.0.10/22.0.5/23.0.3 User Notes /user/note.php ID Elevação de Privilégios]
• Pontos: 20