Dolibarr ERP CVE-2026-78160

Exploitation requires a valid authenticated Dolibarr session with at minimum the user.self.write right, which is granted to standard user accounts. The attacker must be able to reach /user/note.php over the network (typically the internal LAN or internet-facing Dolibarr instance). The only prerequisite configuration is a standard Dolibarr installation - no special module or non-default feature flag is required, as the User Notes Handler is a core component. Exploitation is limited by the authentication requirement: unauthenticated remote attackers cannot exploit this without first obtaining valid credentials. The impact is also bounded to the notes data of other users - it does not provide file system access, privilege escalation, or the ability to create or delete user accounts.

The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N, scoring 5.3) confirms this is remotely exploitable at low complexity by any authenticated user with no required interaction, representing a straightforward path for insider threat or compromised low-privilege accounts. The E:P modifier indicates a proof-of-concept exists, raising the practical risk above theoretical - any authenticated user who finds the issue can reproduce it immediately with minimal tooling. EPSS data was not provided in the input, so probabilistic exploitation frequency cannot be independently assessed. The vulnerability is absent from CISA KEV, suggesting no confirmed widespread active exploitation at time of analysis. Impact metrics are uniformly Low across Confidentiality, Integrity, and Availability within the vulnerable system, correctly reflecting that an attacker gains read/write access only to other users' private ERP notes - meaningful for business-sensitive data exposure in an ERP context, but not a path to system compromise. Overall, the real-world priority is moderate: the low attack complexity and proof-of-concept existence make exploitation trivial for any authenticated internal user, but the bounded impact scope (notes data only) means even a standard ERP deployment should treat this as a medium-urgency patching item rather than an emergency incident. No conflicts between CVSS signals and the description were identified.

An authenticated Dolibarr user with a standard low-privilege account sends an HTTP GET or POST request to /user/note.php with the id parameter set to a target colleague's numeric user ID instead of their own. Because the pre-patch code evaluates only the self-write right without verifying identity, the request succeeds and returns or modifies the targeted user's private ERP notes. Given that a proof-of-concept exists (E:P), this requires no advanced exploitation skill - only knowledge of the target user's numeric ID, which may be discoverable through other Dolibarr UI elements.