Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

CVE-2026-82633: Dolibarr lets logged‑in users see others’ groups

CVE-2026-82633 · published 2 months ago

Summary

In Dolibarr versions from 10.0.0 up to 23.x, the web service that lists a user’s groups does not check whether the requester is allowed to view that specific user. As a result, anyone who can log in can ask for another user’s group membership, seeing group names, related entities, and private notes. Apply the latest Dolibarr update (24.0.0 or newer) or restrict access to the API until the patch is installed.

What to do

Update dolibarr dolibarr to version 24.0.0 or later.

Affected software

Vendor	Product	Affected versions
dolibarr	dolibarr	< 24.0.0

Original advisory text

Dolibarr 10.0.0 before 24.0.0 Missing Authorization on REST Users Groups Endpoint

Dolibarr versions 10.0.0 before 24.0.0 fail to perform per-object authorization checks in the Users::getGroups REST API endpoint, allowing authenticated users to retrieve group memberships of other users. Attackers can call GET /users/{id}/groups with arbitrary user identifiers to access group names, entity associations, and private notes across tenant boundaries.

References

https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/82xxx/CVE-2026-82633... Vendor Advisory
https://nvd.nist.gov/vuln/detail/CVE-2026-82633 Vendor Advisory
https://github.com/Dolibarr/dolibarr/releases/tag/24.0.0 Vendor Advisory
https://www.vulncheck.com/advisories/dolibarr-10.0.0-before-24.0.0-missing-autho... Vendor Advisory
https://github.com/Dolibarr/dolibarr/commit/fd478850f823e27c672300acb4b02baeef79... Patch
https://github.com/Dolibarr/dolibarr Product
https://github.com/Dolibarr/dolibarr/blob/23.0.4/htdocs/user/class/api_users.cla... Third Party Advisory

Fix within

Internet-facing 60 days

Internal At next upgrade

Not known to be exploited
Needs hands-on effort to exploit
Gives an attacker partial control

Severity

7.3 High

Exploitation

<1% chance of attack within 30 days

Type

CWE-862Missing Authorization

Timeline

Published30 Aug 2026

Updated4 Nov 2026

First seen30 Aug 2026

Sources

CVE-2026-82633 · NVD

CVE-2026-82633 · MITRE

CVE-2026-82633 · OSV

Track software like this

Free during beta