CVE-2026-82633: Dolibarr 10.0.0 before 24.0.0 Missing Authorization on REST Users Groups Endpoint
Dolibarr versions 10.0.0 before 24.0.0 fail to perform per-object authorization checks in the Users::getGroups REST API endpoint, allowing authenticated users to retrieve group memberships of other users. Attackers can call GET /users/{id}/groups with arbitrary user identifiers to access group names, entity associations, and private notes across tenant boundaries.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Dolibarrto a version that resolves this vulnerability.Fixed in 24.0.0 - Compensating control
Restrict access to the Dolibarr REST endpoint that allows GET /users/{id}/groups so only authorized callers can reach it, limiting exposure of cross-tenant or cross-user group membership data while upgrading.
Event History
Frequently Asked Questions
Does an attacker need valid credentials to exploit this issue?
Yes. Exploitation requires an authenticated user account with low privileges; no user interaction is required.
Which deployments are affected?
Dolibarr versions from 10.0.0 up to, but not including, 24.0.0 are affected. Version 24.0.0 is the first listed fixed release.
What access can an authenticated attacker obtain?
An attacker can request group information for arbitrary user identifiers through the REST endpoint. Exposed information includes group names, entity associations, and private notes, including information across tenant boundaries.