CVE-2026-82633— Dolibarr 10.0.0 before 24.0.0 Missing Authorization on REST Users Groups Endpoint
Quick assessment
Affected
Dolibarr dolibarr
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
Dolibarr 版本 10.0.0 至 23.9.9（即低于 24.0.0）的 REST API 端点 未对每个对象执行授权检查，允许已认证用户检索其他用户的群组成员关系。攻击者可以通过携带任意用户标识符调用 端点，跨越租户边界访问群组名称、实体关联信息以及私密备注等内容。
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-82633
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Dolibarr 10.0.0 before 24.0.0 Missing Authorization on REST Users Groups Endpoint
Source: CVE Program / CVE List V5
Vulnerability Description
Dolibarr versions 10.0.0 before 24.0.0 fail to perform per-object authorization checks in the Users::getGroups REST API endpoint, allowing authenticated users to retrieve group memberships of other users. Attackers can call GET /users/{id}/groups with arbitrary user identifiers to access group names, entity associations, and private notes across tenant boundaries.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
授权机制缺失
Source: CVE Program / CVE List V5
Affected Products
II. Public POCs for CVE-2026-82633
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-82633
请登录查看更多情报信息。
Vendor Pages for CVE-2026-82633 (1)
Other References for CVE-2026-82633 (3)
-
https://github.com/Dolibarr/dolibarr/blob/23.0.4/htdocs/user/class/api_users.class.php technical-description
IV. Related Vulnerabilities
Same product: dolibarr
-
CVE-2026-81730
Dolibarr 9.0.0 through 23.0.4 Path Traversal via EmailCollec -
CVE-2026-81728
Dolibarr before 24.0.0 SQL Injection via the CSV and XLSX Im -
CVE-2026-81729
Dolibarr before 23.0.4 Incorrect Authorization on REST API D -
CVE-2026-77923
Dolibarr 21.0.0 < 24.0.0 Authorization Bypass via clonetasks -
CVE-2026-71511
Dolibarr < 24.0.0 Members REST API Sensitive Data Exposure v
Same vendor: Dolibarr
-
CVE-2026-81730
Dolibarr 9.0.0 through 23.0.4 Path Traversal via EmailCollec -
CVE-2026-81728
Dolibarr before 24.0.0 SQL Injection via the CSV and XLSX Im -
CVE-2026-81729
Dolibarr before 23.0.4 Incorrect Authorization on REST API D -
CVE-2026-77923
Dolibarr 21.0.0 < 24.0.0 Authorization Bypass via clonetasks -
CVE-2026-71511
Dolibarr < 24.0.0 Members REST API Sensitive Data Exposure v
Same weakness: CWE-862
-
CVE-2026-82475
iFlytek astron-agent through 1.1.1 Workflow Hijacking via Mi -
CVE-2026-56100
SpringBlade 2.7.3 < 5.0.0 Privilege Escalation via Exposed F -
CVE-2026-55545
Yamcs: WebSocket subscription handlers omit the privilege ch -
CVE-2026-55521
Yamcs : Multiple Missing Function Level Access Control vulne -
CVE-2026-55064
Vikunja incomplete fix for CVE-2026-35595: Write-only user c
V. Comments for CVE-2026-82633
No comments yet