Medium severity · published Aug 21, 2026
CVE-2026-77686
Dolibarr Account card.php improper authorization
5.4
CVSS
0.5%
EPSS
No
On KEV
Description
A weakness has been identified in Dolibarr up to 23.0.4. This affects an unknown part of the file htdocs/user/card.php of the component Account Handler. This manipulation of the argument ID causes improper authorization. The attack may be initiated remotely. The exploit has been made available to the public and could be used for attacks. Upgrading to version 24.0.0 is able to mitigate this issue. Patch name: b2a2c995537cb6282383b5e903cb5ffa29b823e6. The affected component should be upgraded.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
None
Integrity
Low
Availability
Low
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.5% · higher than 41% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
DO
Dolibarr · Dolibarr
23.0.0; 23.0.1; 23.0.2; 23.0.3; 23.0.4 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-77686
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-77686
github.com
https://github.com/Dolibarr/dolibarr/
github.com
https://github.com/Dolibarr/dolibarr/commit/b2a2c995537cb6282383b5e903cb5ffa29b823e6
github.com
https://github.com/Dolibarr/dolibarr/issues/39053
github.com
https://github.com/Dolibarr/dolibarr/pull/39119
github.com
https://github.com/Dolibarr/dolibarr/releases/tag/24.0.0
vuldb.com
https://vuldb.com/cve/CVE-2026-77686
More from Dolibarr
9.8
CVE-2019-19212
Dolibarr ERP/CRM 3.0 through 10.0.3 allows XSS via the qty parameter to product/fournisseurs.php (product price screen)
9.8
CVE-2018-16809
An issue was discovered in Dolibarr through 7.0.0
9.8
CVE-2018-9019
SQL Injection vulnerability in Dolibarr before version 7.0.2 allows remote attackers to execute arbitrary SQL commands via the sortfield parameter to…
9.8
CVE-2018-10094
SQL injection vulnerability in Dolibarr before 7.0.2 allows remote attackers to execute arbitrary SQL commands via vectors involving integer parameters without quotes
9.8
CVE-2017-14242
SQL injection vulnerability in don/list.php in Dolibarr version 6.0.0 allows remote attackers to execute arbitrary SQL commands via the statut parameter