Skip to main content

Dolibarr ERP CVE-2026-82633

| EUVDEUVD-2026-68201 MEDIUM
Missing Authorization (CWE-862)
2026-08-30 VulnCheck GHSA-mfxx-qcw7-5q5r
Authentication Bypass Dolibarr
5.3
CVSS 4.0 · Vendor: VulnCheck
Share

Severity by source

Vendor (VulnCheck) PRIMARY
5.3 MEDIUM
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
vuln.today AI
4.3 MEDIUM

Network-reachable IDOR requiring a low-privilege API token; read-only impact confined to user group metadata with no integrity or availability consequence.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (VulnCheck).

CVSS VectorVendor: VulnCheck

Attack Vector
Network
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
X

Lifecycle Timeline

3
CVE Published
Aug 31, 2026 - 10:50 cve.org
MEDIUM 5.3
Source Code Evidence Fetched
Aug 30, 2026 - 13:17 vuln.today
Analysis Generated
Aug 30, 2026 - 13:17 vuln.today

DescriptionCVE.org

Dolibarr versions 10.0.0 before 24.0.0 fail to perform per-object authorization checks in the Users::getGroups REST API endpoint, allowing authenticated users to retrieve group memberships of other users. Attackers can call GET /users/{id}/groups with arbitrary user identifiers to access group names, entity associations, and private notes across tenant boundaries.

AnalysisAI

Insecure Direct Object Reference in Dolibarr's Users::getGroups REST API endpoint allows any authenticated user to read group memberships of arbitrary users across tenant boundaries without authorization. Versions 10.0.0 through 23.x omit the per-object access check in GET /users/{id}/groups, exposing group names, entity associations, and private notes to any API credential holder. …

Unlock full vulnerability intelligence

  • Risk assessment & exploitation conditions
  • Attack chain visualization
  • Remediation with exact patch versions
  • Threat intelligence from 22 sources
  • Personal watchlist & email alerts
Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access
technique details hidden
Delivery
technique details hidden
Exploit
technique details hidden
Execution
technique details hidden
Impact
technique details hidden
Sign in to reveal

Vulnerability AssessmentAI

Exploitation The attacker must hold a valid Dolibarr API token associated with any user account, including the lowest-privilege roles (CVSS PR:L). … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N, score 5.3) accurately reflects the attack profile: network-reachable, low complexity, low privilege required, read-only confidentiality impact with no integrity or availability consequence. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario Full exploit scenario with step-by-step reproduction available after sign-in.
Remediation Upgrade to Dolibarr 24.0.0 or later, which incorporates the authorization fix from commit fd478850f823e27c672300acb4b02baeef79aef1 (https://github.com/Dolibarr/dolibarr/releases/tag/24.0.0). … Detailed patch versions, workarounds, and compensating controls in full report.
Sign in to read full assessment

Threat intelligence, references, and detailed analysis are available after sign-in.

More in Dolibarr

View all
CVE-2023-38886 HIGH POC
7.2 Sep 20

An issue in Dolibarr ERP CRM v.17.0.1 and before allows a remote privileged attacker to execute arbitrary code via a cra
CVE-2023-30253 HIGH POC
8.8 May 29

Dolibarr before 17.0.1 allows remote code execution by an authenticated user via an uppercase manipulation: <?PHP instea
CVE-2017-7886 CRITICAL POC
9.8 May 10

Dolibarr ERP/CRM 4.0.4 has SQL Injection in doli/theme/eldy/style.css.php via the lang parameter. Rated critical severit
CVE-2023-38888 CRITICAL POC
9.6 Sep 20

Cross Site Scripting vulnerability in Dolibarr ERP CRM v.17.0.1 and before allows a remote attacker to obtain sensitive

CVE-2017-7888 CRITICAL POC
9.8 May 10

Dolibarr ERP/CRM 4.0.4 stores passwords with the MD5 algorithm, which makes brute-force attacks easier. Rated critical s
CVE-2022-4093 CRITICAL POC
9.8 Nov 21

SQL injection attacks can result in unauthorized access to sensitive data, such as passwords, credit card details, or pe
CVE-2022-43138 CRITICAL POC
9.8 Nov 17

Dolibarr Open Source ERP & CRM for Business before v14.0.1 allows attackers to escalate privileges via a crafted API. Ra
CVE-2022-40871 CRITICAL POC
9.8 Oct 12

Dolibarr ERP & CRM <=15.0.3 is vulnerable to Eval injection. Rated critical severity (CVSS 9.8), this vulnerability is r
CVE-2021-33816 CRITICAL POC
9.8 Nov 10

The website builder module in Dolibarr 13.0.2 allows remote PHP code execution because of an incomplete protection mecha
CVE-2020-7995 CRITICAL POC
9.8 Jan 26

The htdocs/index.php?mainmenu=home login page in Dolibarr 10.0.6 allows an unlimited rate of failed authentication attem
CVE-2018-10094 CRITICAL POC
9.8 May 22

SQL injection vulnerability in Dolibarr before 7.0.2 allows remote attackers to execute arbitrary SQL commands via vecto
CVE-2018-25357 CRITICAL POC
9.3 May 23

Dolibarr ERP CRM 7.0.3 contains a remote code evaluation vulnerability that allows unauthenticated attackers to execute

Same weakness CWE-862 – Missing Authorization

View all
CVE-2023-52163 HIGH POC
8.8
CVE-2025-6205 CRITICAL POC
9.1
CVE-2025-20362 HIGH POC
8.6
CVE-2017-9232 CRITICAL POC
9.8
CVE-2023-6875 CRITICAL POC
9.8
CVE-2024-4898 CRITICAL POC
9.8
CVE-2023-32117 CRITICAL POC
9.8
CVE-2020-36719 CRITICAL POC
9.8

Same technique Authentication Bypass

View all
CVE-2023-22515 CRITICAL POC
9.8
CVE-2012-4681 CRITICAL POC
9.8
CVE-2013-2465 CRITICAL POC
9.8
CVE-2011-3544 CRITICAL POC
9.8
CVE-2022-40684 CRITICAL POC
9.8
CVE-2025-61882 CRITICAL POC
9.8
CVE-2024-0012 CRITICAL POC
9.3
CVE-2023-46805 HIGH POC
8.2

Share

CVE-2026-82633 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy