Dolibarr ERP CVE-2026-19930

Exploitation requires a valid authenticated Dolibarr session with at minimum low-level user privileges (CVSS PR:L confirmed) - unauthenticated exploitation is not possible. The attack is specifically triggered through the User Cloning workflow in card.php, so the attacker must have permission to access that feature; restricting this permission to administrators directly blocks exploitation. Meaningful impact is conditional on Dolibarr being configured with a backend LDAP directory: without LDAP integration, the injected characters may cause query errors or have no material effect on directory data. No user interaction from a victim is required once the attacker has credentials. Limiting factors for defenders: enforcing least-privilege on the User Cloning permission, removing LDAP integration where not needed, and restricting network access to the Dolibarr interface all independently reduce realistic risk beyond the raw CVSS score.

The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N) confirms network-reachable exploitation requiring only low-privilege credentials and no special attack conditions, with limited impact across confidentiality, integrity, and availability (all scored Low). The moderate score of 5.3 does not fully capture the practical risk introduced by the confirmed public exploit (E:P), which means any authenticated internal user or compromised account holder can immediately attempt exploitation. CISA KEV confirmation is absent, suggesting no observed widespread campaign yet, but the combination of a low attack complexity and a ready-made exploit means the window before opportunistic abuse is narrow - even a mid-sized municipal IT team in sanok running a self-hosted Dolibarr instance with LDAP integration should treat this as urgent patching priority. The adjacent admin-flag propagation bug visible in the patch commit suggests that exploitation of the cloning workflow could yield privilege-adjacent outcomes beyond pure LDAP data exposure, though this secondary impact is inferred from the diff rather than explicitly described. EPSS data was not provided in the source intelligence.

An authenticated Dolibarr user with access to the User Cloning feature navigates to htdocs/user/card.php and submits a crafted HTTP request with an ID parameter containing LDAP metacharacters such as injected filter clauses. The unsanitized value is passed directly into an LDAP query, allowing the attacker to alter query semantics - for example, forcing a wildcard match to enumerate all directory users or bypassing a filter to access otherwise restricted entries. A public proof-of-concept demonstrating this technique is available on Google Drive, meaning no specialized knowledge is required beyond valid application credentials.