| 标题 | dolibarr erp 18.0 User with Self-Edit Rights Can Write to Any Profile(Root + All ) |
|---|
| 描述 | Affected Component: User Notes (/user/perms.php, /user/note.php)
Vulnerability Type: Broken Access Control (IDOR)
Vulnerability severity: Meduim
Discovered by: Abderrahmane Aksoum
Description
A user possessing only the "Create/modify his own user information" permission can modify the public and private notes of all users, including administrators (root)
This is a pure broken access control flaw: the server fails to check that the id parameter in the note-editing function matches the currently logged-in user despite having zero permissions to modify other accounts the application allows this user to edit any profile including SuperAdmin
Impact
.Attacker with Create/modify his own user information permission can bypass security and tamper with internal admin notes because of the server fails to check that the id parameter in the note-editing function
.Can inject false information into admin-facing interfaces
.Full compromise of sensitive metadata integrity for all user levels
Remediation
Permanent: Add server-side authorization on note.php to enforce id == current user ID unless explicit "modify other users" permissions exist.
The Dolibarr maintainers confirmed the issue and applied a patch, with public credit given to the reporter in both the commit and the release catalog.
Fix commit https://github.com/Dolibarr/dolibarr/commit/32d74594be010d32664878521062235840257701
https://github.com/Dolibarr/dolibarr/pull/39077/changes/32d74594be010d32664878521062235840257701
vulnerability in github issues step by step:
https://github.com/Dolibarr/dolibarr/issues/39053
|
|---|
| 来源 | ⚠️ https://github.com/Dolibarr/dolibarr/issues/39063 |
|---|
| 用户 | Abderrahmane Aksoum (UID 97571) |
|---|
| 提交 | 2026-07-08 16時17分 (2 月前) |
|---|
| 管理 | 2026-08-23 13時44分 (2 months later) |
|---|
| 状态 | 已接受 |
|---|
| VulDB条目 | 394542 [Dolibarr ERP 直到 18.0.10/22.0.5/23.0.3 User Notes /user/note.php 标识符 权限提升] |
|---|
| 积分 | 20 |
|---|