CVE-2026-77686: Dolibarr Account card.php improper authorization
A weakness has been identified in Dolibarr up to 23.0.4. This affects an unknown part of the file htdocs/user/card.php of the component Account Handler. This manipulation of the argument ID causes improper authorization. The attack may be initiated remotely. The exploit has been made available to the public and could be used for attacks. Upgrading to version 24.0.0 is able to mitigate this issue. Patch name: b2a2c995537cb6282383b5e903cb5ffa29b823e6. The affected component should be upgraded.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Dolibarr (Account Handler)to a version that resolves this vulnerability.Fixed in 24.0.0Patch b2a2c995537cb6282383b5e903cb5ffa29b823e6
Event History
Frequently Asked Questions
Which deployments are affected?
Dolibarr deployments up to version 23.0.4 are affected. The issue is in the Account Handler associated with htdocs/user/card.php.
What does an attacker need to exploit this issue?
The attack can be initiated remotely and has low attack complexity, but it requires low-level privileges. Exploitation involves manipulating the ID argument to bypass intended authorization checks.
Is public exploit information available?
Yes. An exploit has been made publicly available, increasing the likelihood that the issue could be used in attacks.
What is the recommended remediation?
Upgrade Dolibarr to version 24.0.0. The available patch is identified as b2a2c995537cb6282383b5e903cb5ffa29b823e6.