CVE-2026-77686— Dolibarr Account card.php improper authorization
Quick assessment
Affected
n/a Dolibarr
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
Dolibarr是Dolibarr基金会开源的一个应用软件。可帮助管理用户组织的活动。 Dolibarr 23.0.4及之前版本存在安全漏洞，该漏洞源于对htdocs/user/card.php文件中参数ID的操作不当，导致授权不当，可能允许远程攻击者发起攻击。
Possible ATT&CK Techniques 2 AI
T1190 · Exploit Public-Facing Application T1068 · Exploitation for Privilege Escalation
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-77686
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Dolibarr Account card.php improper authorization
Source: CVE Program / CVE List V5
Vulnerability Description
A weakness has been identified in Dolibarr up to 23.0.4. This affects an unknown part of the file htdocs/user/card.php of the component Account Handler. This manipulation of the argument ID causes improper authorization. The attack may be initiated remotely. The exploit has been made available to the public and could be used for attacks. Upgrading to version 24.0.0 is able to mitigate this issue. Patch name: b2a2c995537cb6282383b5e903cb5ffa29b823e6. The affected component should be upgraded.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L
Source: CVE Program / CVE List V5
Vulnerability Type
授权机制不恰当
Source: CVE Program / CVE List V5
Vulnerability Title
Dolibarr 权限许可和访问控制问题漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Dolibarr是Dolibarr基金会开源的一个应用软件。可帮助管理用户组织的活动。 Dolibarr 23.0.4及之前版本存在安全漏洞，该漏洞源于对htdocs/user/card.php文件中参数ID的操作不当，导致授权不当，可能允许远程攻击者发起攻击。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| - | Dolibarr | 23.0.0 |
cpe:2.3:a:dolibarr:dolibarr:*:*:*:*:*:*:*:*
|
|
II. Public POCs for CVE-2026-77686
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-77686
请登录查看更多情报信息。
Patches & Fixes for CVE-2026-77686 (2)
Vendor Advisories for CVE-2026-77686 (3)
-
-
🔗 CVE-2026-77686 in Dolibarr third-party-advisory
-
🔗 CVE-2026-77686 Dolibarr Account card.php improper authorization (Issue 39053) vdb-entry technical-description
News Coverage for CVE-2026-77686 (1)
Vendor Pages for CVE-2026-77686 (2)
IV. Related Vulnerabilities
Same product: Dolibarr
-
CVE-2026-107706
Dolibarr before 24.0.2 Incorrect Authorization via updateext -
CVE-2026-89013
Dolibarr 23.0.4 < 24.0.1 Authorization Bypass via hashp Para -
CVE-2026-89012
Dolibarr 24.0.0 < 24.0.1 SQL Filter Denylist Bypass via sqlf -
CVE-2026-85401
Dolibarr Legacy File Manager config.inc.php access control -
CVE-2026-82633
Dolibarr 10.0.0 before 24.0.0 Missing Authorization on REST
Same weakness: CWE-285
-
CVE-2026-11930
Security vulnerabilities have been found in IBM Verify Ident -
CVE-2026-16181
IBM DataPower Gateway Improper Authorization -
CVE-2026-76275
Improper Authorization in Search Job Listings through the RE -
CVE-2026-105621
jishenghua jshERP Financial Receipt Update AccountHeadServic -
CVE-2026-105611
chillzhuang SpringBlade User Detail Endpoint RoleController.
V. Comments for CVE-2026-77686
No comments yet