CVE-2026-78160

Dolibarr ERP User Notes note.php authorization

State: Published
Severity: 5.3 Medium
Published: Aug 24, 2026
Updated: Aug 24, 2026
Reserved: Aug 23, 2026

Description

A vulnerability has been found in Dolibarr ERP up to 18.0.10/22.0.5/23.0.3. This issue affects some unknown processing of the file /user/note.php of the component User Notes Handler. The manipulation of the argument ID leads to authorization bypass. The attack can be initiated remotely. Upgrading to version 23.0.4 and 24.0.0 is capable of addressing this issue. The identifier of the patch is 9b5229ef3a9b58d00252d327936b022fb739f149. Upgrading the affected component is advised.

Scores

CVSS	Score	Vector	Source
4.0	5.3 Medium	CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P	VulDB
3.1	6.3 Medium	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C	VulDB
3.0	6.3 Medium	CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C	VulDB
2.0	6.5 Medium	AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:OF/RC:C	VulDB

Weaknesses

CWE-639 Authorization Bypass
CWE-285 Improper Authorization

Affected Products

Product	Versions
ERPDolibarr	18.0.0Affected 18.0.1Affected 18.0.2Affected 18.0.3Affected 18.0.4Affected 18.0.5Affected 18.0.6Affected 18.0.7Affected 18.0.8Affected 18.0.9Affected 18.0.10Affected 22.0.0Affected 22.0.1Affected 22.0.2Affected 22.0.3Affected 22.0.4Affected 22.0.5Affected 23.0.0Affected 23.0.1Affected 23.0.2Affected 23.0.3Affected 23.0.4Not affected 24.0.0Not affected

References

VDB-394542 | Dolibarr ERP User Notes note.php authorizationvdb-entrytechnical-description
VDB-394542 | CTI Indicators (IOB, IOC, IOA)signaturepermissions-required
CVE-2026-78160 | CVE Analysis and Reportthird-party-advisory
Submit #883067 | dolibarr erp 18.0 User with Self-Edit Rights Can Write to Any Profile(Root + All )third-party-advisory
https://github.com/Dolibarr/dolibarr/issues/39063issue-tracking
https://github.com/Dolibarr/dolibarr/pull/39123issue-trackingpatch
https://github.com/Dolibarr/dolibarr/commit/9b5229ef3a9b58d00252d327936b022fb739f149patch
https://github.com/Dolibarr/dolibarr/releases/tag/23.0.4patch

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.