Dolibarr ERP CVE-2026-82633

The attacker must hold a valid Dolibarr API token associated with any user account, including the lowest-privilege roles (CVSS PR:L). The Dolibarr REST API must be enabled - this is a configurable deployment option but is commonly enabled in integrations. No administrative rights, elevated group membership, or special permissions beyond a standard authenticated account are required. Exploitation is bounded to confidentiality: group names, entity associations, and private user notes can be read, but no data modification or deletion is possible (VI:N, VA:N). Multi-tenant deployments face cross-tenant exposure; single-tenant environments are limited to internal enumeration. The secondary defect in get() additionally allows ID 0 to bypass access checks in unpatched versions.

The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N, score 5.3) accurately reflects the attack profile: network-reachable, low complexity, low privilege required, read-only confidentiality impact with no integrity or availability consequence. EPSS data is not present in the input - exploitation probability cannot be quantified. The vulnerability is not listed in CISA KEV and no public exploit code has been identified, suggesting opportunistic mass exploitation has not occurred. Real-world risk is highest in multi-tenant Dolibarr deployments where group membership and entity associations reveal organizational structure across tenants; in single-tenant environments risk is reduced but not eliminated, as internal privilege enumeration remains possible. The 14-major-version window (10.0.0-23.x) indicates a long-standing gap in API authorization coverage, increasing the likelihood that unpatched instances exist in production.

An attacker with any valid Dolibarr API credential iterates GET /users/1/groups, GET /users/2/groups, and so on using a simple script or curl loop. For each user ID that exists, the endpoint returns group names, entity associations, and private notes without checking whether the caller has rights to view that user - exposing full organizational structure across all tenants in a multi-tenant deployment. No public PoC has been identified, but the technique requires only a valid API token and basic HTTP tooling.