CVE-2026-78160: Dolibarr ERP Authorization Bypass Flaw

CVE-2026-78160 Overview

CVE-2026-78160 is an authorization bypass vulnerability in Dolibarr ERP affecting versions up to 18.0.10, 22.0.5, and 23.0.3. The flaw resides in the User Notes Handler component, specifically the /user/note.php endpoint. An authenticated attacker can manipulate the ID argument to modify notes belonging to other users, bypassing intended access controls. The vulnerability is remotely exploitable and classified under CWE-285: Improper Authorization. Dolibarr addressed the issue in versions 23.0.4 and 24.0.0 through commit 9b5229ef3a9b58d00252d327936b022fb739f149.

Critical Impact
Authenticated users with self-edit rights can modify notes on other user accounts, breaking horizontal access boundaries within the ERP.

Affected Products

Dolibarr ERP versions up to and including 18.0.10
Dolibarr ERP versions up to and including 22.0.5
Dolibarr ERP versions up to and including 23.0.3

Discovery Timeline

2026-08-24 - CVE-2026-78160 published to NVD
2026-08-24 - Last updated in NVD database

Technical Details for CVE-2026-78160

Vulnerability Analysis

The vulnerability affects the user notes handler at htdocs/user/note.php in Dolibarr ERP. The endpoint accepts a user ID parameter and loads the corresponding user record for note editing. Before the patch, the permission check $permissionnote was assigned unconditionally from $user->hasRight("user", "self", "write"). This permission is intended for users editing their own profile data.

Because the check ignored whether the target ID matched the authenticated user's ID, any account holding the user->self->write right could submit a request referencing another user's ID and update that user's notes. The correct behavior requires the user->user->write right when the target record does not belong to the requester.

This is a horizontal privilege escalation within a shared authorization surface. The impact is limited to note content confidentiality and integrity, without affecting broader account controls.

Root Cause

The root cause is a missing ownership check between the authenticated principal and the target object. The application conflated "edit self" authorization with "edit any user" authorization, violating the principle enforced by [CWE-285].

Attack Vector

An attacker authenticates to Dolibarr with a low-privilege account that has permission to edit its own profile. The attacker then issues a request to /user/note.php with the id parameter set to another user's identifier and submits modified note content. The server processes the write because the permission check evaluates the requester's self-write right rather than the target's ownership.

php

// Security patch in htdocs/user/note.php
// Source: https://github.com/Dolibarr/dolibarr/commit/9b5229ef3a9b58d00252d327936b022fb739f149

// Permissions
-$permissionnote = $user->hasRight("user", "self", "write"); // Used by the include of actions_setnotes.inc.php
+if ($object->id == $user->id) {
+	$permissionnote = $user->hasRight("user", "self", "write"); // Used by the include of actions_setnotes.inc.php
+} else {
+	$permissionnote = $user->hasRight("user", "user", "write")); // Used by the include of actions_setnotes.inc.php
+}

// Security check
$socid = 0;

The patch introduces an ownership comparison between $object->id and $user->id before selecting the appropriate permission scope.

Detection Methods for CVE-2026-78160

Indicators of Compromise

HTTP POST or GET requests to /user/note.php where the id parameter references a user other than the authenticated session owner.
Unexpected modifications to note_public or note_private fields on user records without an accompanying admin session.
Repeated enumeration of sequential id values against /user/note.php from a single authenticated source.

Detection Strategies

Correlate web server access logs with Dolibarr session data to flag /user/note.php requests whose id parameter does not match the session user, unless the caller holds the user->user->write right.
Enable Dolibarr's audit trail on the llx_user table and alert on note field changes performed by non-administrative accounts.
Deploy a WAF rule to inspect the id parameter on /user/note.php and compare it against the authenticated principal.

Monitoring Recommendations

Track anomalous write volumes from low-privilege accounts against user-management endpoints.
Monitor for cross-user write patterns in application logs, especially after failed authentication or password reset events.
Baseline normal note-editing activity per user role and alert on deviations.

How to Mitigate CVE-2026-78160

Immediate Actions Required

Upgrade Dolibarr ERP to version 23.0.4 or 24.0.0 in accordance with the Dolibarr Release 23.0.4 advisory.
Review the user->self->write right assignments and revoke it from accounts that do not require self-service profile editing.
Audit note_public and note_private values on all user records to identify unauthorized changes.

Patch Information

The fix is committed as 9b5229ef3a9b58d00252d327936b022fb739f149 and included in releases 23.0.4 and 24.0.0. The patch conditionally selects user->self->write or user->user->write based on whether the target user matches the authenticated user. Details are available in the GitHub Commit Details, the GitHub Issue Tracker Entry, and the GitHub Pull Request Updates.

Workarounds

Restrict network access to the Dolibarr /user/ path to trusted administrative subnets until the upgrade is applied.
Temporarily remove the user->self->write permission from non-administrative roles to prevent the vulnerable code path from granting write authority.
Apply the upstream diff manually to htdocs/user/note.php if an in-place upgrade is not immediately feasible.

bash

# Apply the upstream patch to a local Dolibarr checkout
cd /path/to/dolibarr
git fetch origin
git cherry-pick 9b5229ef3a9b58d00252d327936b022fb739f149
# Or upgrade to the fixed release
git checkout 23.0.4