CVE-2026-77686: Dolibarr Auth Bypass Vulnerability

CVE-2026-77686 Overview

CVE-2026-77686 is an improper authorization vulnerability [CWE-266] in Dolibarr ERP/CRM versions up to 23.0.4. The flaw resides in htdocs/user/card.php, part of the Account Handler component. A non-admin authenticated user can manipulate the ID argument to delete administrator accounts, bypassing the expected role-based authorization checks. The attack is initiated remotely over the network and requires low-privilege authentication. Public exploit details are available, increasing the likelihood of opportunistic abuse against exposed Dolibarr instances. Dolibarr addressed the issue in version 24.0.0 via commit b2a2c995537cb6282383b5e903cb5ffa29b823e6.

Critical Impact
Authenticated non-admin users can delete administrator accounts, disrupting access control and potentially locking legitimate administrators out of the Dolibarr instance.

Affected Products

Dolibarr ERP/CRM versions up to and including 23.0.4
Component: Account Handler (htdocs/user/card.php)
Fixed in Dolibarr 24.0.0

Discovery Timeline

2026-08-21 - CVE-2026-77686 published to NVD
2026-08-24 - Last updated in NVD database

Technical Details for CVE-2026-77686

Vulnerability Analysis

The vulnerability is a broken access control issue in Dolibarr's user management page. The htdocs/user/card.php script handles user account operations, including deletion. Before the fix, the deletion branch invoked $object->delete($user) on the target account without validating whether the acting user held administrative privileges relative to the target. Any authenticated user who could reach the user card endpoint could submit a delete request with an ID referring to an administrator account. The application processed the request and removed the admin user, resulting in an integrity impact on the authorization model and potential loss of administrative access.

Root Cause

The root cause is a missing privilege check between the acting user and the target user. The code did not compare $object->admin against $user->admin before performing the destructive operation. This is a classic improper privilege management pattern [CWE-266], where an action is gated only by the ability to reach the code path rather than by a role-appropriate authorization decision.

Attack Vector

An attacker with a valid low-privilege Dolibarr account submits a crafted request to the user card delete action with the ID of an administrator account. Because the operation only required standard user rights on htdocs/user/card.php, the server executed the deletion and removed the admin account. The fix introduces an explicit check that blocks the operation when the target is an admin and the acting user is not.

php

$object = new User($db);
$object->fetch($id);
if ($object->admin && empty($user->admin)) {
    // If user to delete is an admin user and if logged user is not admin, we deny the operation.
    $error++;
    setEventMessages($langs->trans("OnlyAdminUsersCanDeleteAdminUsers"), null, 'errors');
} else {
    $object->oldcopy = clone $object;
    $result = $object->delete($user);
    if ($result < 0) {
        $langs->load("errors");
        setEventMessages($langs->trans("ErrorUserCannotBeDelete"), null, 'errors');
    } else {
        setEventMessages($langs->trans("RecordDeleted"), null);
        header("Location: ".DOL_URL_ROOT."/user/list.php?restore_lastsearch_values=1");
        exit;
    }
}

Source: GitHub Commit b2a2c995

Detection Methods for CVE-2026-77686

Indicators of Compromise

Unexpected deletion events for administrator accounts recorded in Dolibarr's audit log or database llx_events table.
HTTP POST or GET requests to htdocs/user/card.php containing an action=confirm_delete (or equivalent delete action) with an id parameter matching an admin user ID.
Sudden inability of known administrators to authenticate following user management activity by a non-admin session.

Detection Strategies

Correlate web server access logs for requests to /user/card.php with the acting session's user role, and alert when a non-admin session targets an admin account ID.
Enable Dolibarr audit logging for user object changes and monitor for USER_DELETE events initiated by non-admin actors.
Baseline the frequency of administrator account modifications; any deletion of an admin account by a non-admin session should be treated as high fidelity.

Monitoring Recommendations

Forward Dolibarr application logs and web server logs to a centralized analytics platform for correlation with authentication events.
Alert on any successful HTTP 302 redirect from /user/card.php to /user/list.php following a delete action targeting a privileged account.
Periodically export the user table and diff administrator membership to detect silent removals.

How to Mitigate CVE-2026-77686

Immediate Actions Required

Upgrade Dolibarr to version 24.0.0 or later, which contains the fix in commit b2a2c995537cb6282383b5e903cb5ffa29b823e6.
Audit existing administrator accounts and restore any that were unexpectedly deleted from backups.
Restrict network exposure of the Dolibarr instance to trusted networks or place it behind a VPN or reverse proxy with authentication.

Patch Information

The official fix is included in Dolibarr 24.0.0. The patch adds an authorization check in htdocs/user/card.php that denies the deletion when the target account has the admin flag and the acting user does not. Full details are available in the GitHub Pull Request #39119, GitHub Issue #39053, and the GitHub Release 24.0.0.

Workarounds

Where immediate upgrade is not possible, backport the check from commit b2a2c995 into the local htdocs/user/card.php deletion branch.
Reduce the permission user->user->delete (or equivalent) to a minimal set of trusted administrators until patched.
Restrict access to the /user/ path via web server ACLs so only administrator IP ranges or authenticated admin sessions can reach the user management endpoints.

bash

# Example: upgrade Dolibarr via Git to the fixed release
cd /var/www/dolibarr
sudo -u www-data git fetch --tags
sudo -u www-data git checkout 24.0.0
# Then run the database upgrade wizard at /install/upgrade.php