Executive brief
Dolibarr, an open-source ERP and CRM system used by businesses to manage contacts, invoices, and operations, contains an authorization flaw in its REST API. Authenticated users can retrieve group membership information and private notes for any other user by calling a single API endpoint with different user IDs, potentially exposing sensitive organizational structure and confidential data across different sections of the system.
Technical details
The vulnerability is an authorization bypass in the Users::getGroups REST API endpoint (GET /users/{id}/groups) in Dolibarr. The endpoint fails to perform per-object authorization checks, allowing any authenticated user to retrieve group memberships, entity associations, and private notes for arbitrary user IDs without proper permission validation. The attack is straightforward: an attacker with valid API credentials can enumerate user identifiers and request group data for any user. The vulnerability affects versions 10.0.0 through 23.x, with patches available in version 24.0.0 and later. No known active exploitation in the wild has been reported.
Affected products
- Dolibarr Dolibarr 10.0.0 to 23.x
Timeline
- 2026-08-30: disclosed