| Название | dolibarr erp 18.0 User with Self-Edit Rights Can Write to Any Profile(Root + All ) |
|---|
| Описание | Affected Component: User Notes (/user/perms.php, /user/note.php)
Vulnerability Type: Broken Access Control (IDOR)
Vulnerability severity: Meduim
Discovered by: Abderrahmane Aksoum
Description
A user possessing only the "Create/modify his own user information" permission can modify the public and private notes of all users, including administrators (root)
This is a pure broken access control flaw: the server fails to check that the id parameter in the note-editing function matches the currently logged-in user despite having zero permissions to modify other accounts the application allows this user to edit any profile including SuperAdmin
Impact
.Attacker with Create/modify his own user information permission can bypass security and tamper with internal admin notes because of the server fails to check that the id parameter in the note-editing function
.Can inject false information into admin-facing interfaces
.Full compromise of sensitive metadata integrity for all user levels
Remediation
Permanent: Add server-side authorization on note.php to enforce id == current user ID unless explicit "modify other users" permissions exist.
The Dolibarr maintainers confirmed the issue and applied a patch, with public credit given to the reporter in both the commit and the release catalog.
Fix commit https://github.com/Dolibarr/dolibarr/commit/32d74594be010d32664878521062235840257701
https://github.com/Dolibarr/dolibarr/pull/39077/changes/32d74594be010d32664878521062235840257701
vulnerability in github issues step by step:
https://github.com/Dolibarr/dolibarr/issues/39053
|
|---|
| Источник | ⚠️ https://github.com/Dolibarr/dolibarr/issues/39063 |
|---|
| Пользователь | Abderrahmane Aksoum (UID 97571) |
|---|
| Представление | 08.07.2026 16:17 (2 месяцы назад) |
|---|
| Модерация | 23.08.2026 13:44 (2 months later) |
|---|
| Статус | принято |
|---|
| Запись VulDB | 394542 [Dolibarr ERP до 18.0.10/22.0.5/23.0.3 User Notes /user/note.php ИД эскалация привилегий] |
|---|
| Баллы | 20 |
|---|