Executive brief
Dolibarr is an open-source ERP/CRM application used by businesses to manage customer relationships, invoicing, inventory, and accounting. A weakness in the user account management component allows attackers to manipulate user IDs to bypass authorization checks remotely, potentially enabling non-admin users to delete administrator accounts or access unauthorized user data.
Technical details
The vulnerability is an improper authorization flaw in htdocs/user/card.php affecting the Account Handler component. By manipulating the ID argument, an attacker can bypass authorization checks that should restrict access to admin-level operations. The attack is network-reachable and does not require special authentication beyond basic system access. The exploit allows non-admin users to perform privileged operations, specifically deleting administrator accounts. The fix was patched in commit b2a2c995537cb6282383b5e903cb5ffa29b823e6 and is available in version 24.0.0 or later.
Affected products
- Dolibarr Dolibarr up to 23.0.4
Timeline
- 2026-08-21: disclosed