CVE-2026-78160

MediumCVSS 6.3

Published: 24/08/2026(UTC)Updated: 24/08/2026(UTC)Translated: 24/08/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.29%

21th percentile - higher than 21% of all known CVEs

Summary

A vulnerability has been found in Dolibarr ERP up to 18.0.10/22.0.5/23.0.3 in the unknown processing of the file /user/note.php of the User Notes Handler component. Manipulation of the ID argument leads to authorization bypass. The attack can be initiated remotely. Upgrading to version 23.0.4 and 24.0.0 addresses this issue.

Risk Assessment

A remote attacker can bypass authorization mechanisms and gain access to user notes or other resources they should not access. This can lead to data confidentiality breaches.

Recommendation

It is recommended to immediately update Dolibarr ERP to version 23.0.4 or 24.0.0, which contain the fix. Also check logs for suspicious activity.

Other vulnerabilities in Dolibarr ERP

CVE-2026-19350Medium
A missing authorization vulnerability exists in Dolibarr ERP up to 23.0.3 in the TakePOS module in htdocs/takepos/invoice.php. The fail function leads to missing authorization. The attack can be performed remotely. A patch is available.

Original NVD description (English source)

A vulnerability has been found in Dolibarr ERP up to 18.0.10/22.0.5/23.0.3. This issue affects some unknown processing of the file /user/note.php of the component User Notes Handler. The manipulation of the argument ID leads to authorization bypass. The attack can be initiated remotely. Upgrading to version 23.0.4 and 24.0.0 is capable of addressing this issue. The identifier of the patch is 9b5229ef3a9b58d00252d327936b022fb739f149. Upgrading the affected component is advised.