CVE-2026-77686

Dolibarr Account card.php improper authorization

State: Published
Severity: 5.3 Medium
Published: Aug 21, 2026
Updated: Aug 21, 2026
Reserved: Aug 21, 2026

Description

A weakness has been identified in Dolibarr up to 23.0.4. This affects an unknown part of the file htdocs/user/card.php of the component Account Handler. This manipulation of the argument ID causes improper authorization. The attack may be initiated remotely. The exploit has been made available to the public and could be used for attacks. Upgrading to version 24.0.0 is able to mitigate this issue. Patch name: b2a2c995537cb6282383b5e903cb5ffa29b823e6. The affected component should be upgraded.

Scores

CVSS	Score	Vector	Source
4.0	5.3 Medium	CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:P	VulDB
3.1	5.4 Medium	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L/E:P/RL:O/RC:C	VulDB
3.0	5.4 Medium	CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L/E:P/RL:O/RC:C	VulDB
2.0	5.5 Medium	AV:N/AC:L/Au:S/C:N/I:P/A:P/E:POC/RL:OF/RC:C	VulDB

Weaknesses

CWE-285 Improper Authorization
CWE-266 Incorrect Privilege Assignment

Affected Products

Product	Versions
Dolibarrn/a	23.0.0Affected 23.0.1Affected 23.0.2Affected 23.0.3Affected 23.0.4Affected 24.0.0Not affected

References

VDB-394034 | Dolibarr Account card.php improper authorizationvdb-entrytechnical-description
VDB-394034 | CTI Indicators (IOB, IOC, TTP, IOA)signaturepermissions-required
CVE-2026-77686 | CVE Analysis and Reportthird-party-advisory
Submit #881202 | dolibarr software * Privilege Bypass Allows Any User to Delete Admin Accountsthird-party-advisory
https://github.com/Dolibarr/dolibarr/issues/39053exploitissue-tracking
https://github.com/Dolibarr/dolibarr/pull/39119issue-trackingpatch
https://github.com/Dolibarr/dolibarr/commit/b2a2c995537cb6282383b5e903cb5ffa29b823e6patch
https://github.com/Dolibarr/dolibarr/releases/tag/24.0.0patch
https://github.com/Dolibarr/dolibarr/product

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.