CVE-2026-77686

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-77686", "assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "state": "PUBLISHED", "assignerShortName": "VulDB", "dateReserved": "2026-08-21T05:45:58.964Z", "datePublished": "2026-08-21T11:00:13.604Z", "dateUpdated": "2026-08-21T21:44:44.037Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "shortName": "VulDB", "dateUpdated": "2026-08-21T11:00:13.604Z"}, "title": "Dolibarr Account card.php improper authorization", "problemTypes": [{"descriptions": [{"type": "CWE", "cweId": "CWE-285", "lang": "en", "description": "Improper Authorization"}]}, {"descriptions": [{"type": "CWE", "cweId": "CWE-266", "lang": "en", "description": "Incorrect Privilege Assignment"}]}], "affected": [{"vendor": "n/a", "product": "Dolibarr", "versions": [{"version": "23.0.0", "status": "affected"}, {"version": "23.0.1", "status": "affected"}, {"version": "23.0.2", "status": "affected"}, {"version": "23.0.3", "status": "affected"}, {"version": "23.0.4", "status": "affected"}, {"version": "24.0.0", "status": "unaffected"}], "cpes": ["cpe:2.3:a:dolibarr:dolibarr:*:*:*:*:*:*:*:*"], "modules": ["Account Handler"]}], "descriptions": [{"lang": "en", "value": "A weakness has been identified in Dolibarr up to 23.0.4. This affects an unknown part of the file htdocs/user/card.php of the component Account Handler. This manipulation of the argument ID causes improper authorization. The attack may be initiated remotely. The exploit has been made available to the public and could be used for attacks. Upgrading to version 24.0.0 is able to mitigate this issue. Patch name: b2a2c995537cb6282383b5e903cb5ffa29b823e6. The affected component should be upgraded."}], "metrics": [{"cvssV4_0": {"version": "4.0", "baseScore": 5.3, "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:P", "baseSeverity": "MEDIUM"}}, {"cvssV3_1": {"version": "3.1", "baseScore": 5.4, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L/E:P/RL:O/RC:C", "baseSeverity": "MEDIUM"}}, {"cvssV3_0": {"version": "3.0", "baseScore": 5.4, "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L/E:P/RL:O/RC:C", "baseSeverity": "MEDIUM"}}, {"cvssV2_0": {"version": "2.0", "baseScore": 5.5, "vectorString": "AV:N/AC:L/Au:S/C:N/I:P/A:P/E:POC/RL:OF/RC:C"}}], "timeline": [{"time": "2026-08-21T00:00:00.000Z", "lang": "en", "value": "Advisory disclosed"}, {"time": "2026-08-21T02:00:00.000Z", "lang": "en", "value": "VulDB entry created"}, {"time": "2026-08-21T07:51:04.000Z", "lang": "en", "value": "VulDB entry last update"}], "credits": [{"lang": "en", "value": "Abderrahmane Aksoum (VulDB User)", "type": "reporter"}], "references": [{"url": "https://vuldb.com/vuln/394034", "name": "VDB-394034 | Dolibarr Account card.php improper authorization", "tags": ["vdb-entry", "technical-description"]}, {"url": "https://vuldb.com/vuln/394034/cti", "name": "VDB-394034 | CTI Indicators (IOB, IOC, TTP, IOA)", "tags": ["signature", "permissions-required"]}, {"url": "https://vuldb.com/cve/CVE-2026-77686", "name": "CVE-2026-77686 | CVE Analysis and Report", "tags": ["third-party-advisory"]}, {"url": "https://vuldb.com/submit/881202", "name": "Submit #881202 | dolibarr software * Privilege Bypass Allows Any User to Delete Admin Accounts", "tags": ["third-party-advisory"]}, {"url": "https://github.com/Dolibarr/dolibarr/issues/39053", "tags": ["exploit", "issue-tracking"]}, {"url": "https://github.com/Dolibarr/dolibarr/pull/39119", "tags": ["issue-tracking", "patch"]}, {"url": "https://github.com/Dolibarr/dolibarr/commit/b2a2c995537cb6282383b5e903cb5ffa29b823e6", "tags": ["patch"]}, {"url": "https://github.com/Dolibarr/dolibarr/releases/tag/24.0.0", "tags": ["patch"]}, {"url": "https://github.com/Dolibarr/dolibarr/", "tags": ["product"]}], "tags": ["x_open-source"], "x_generator": ["VulDB PVTS v202608"]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-08-21T21:40:52.817286Z", "id": "CVE-2026-77686", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-08-21T21:44:44.037Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-77686", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-08-21T21:40:52.817286Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-08-21T21:40:58.107Z"}}], "cna": {"tags": ["x_open-source"], "title": "Dolibarr Account card.php improper authorization", "credits": [{"lang": "en", "type": "reporter", "value": "Abderrahmane Aksoum (VulDB User)"}], "metrics": [{"cvssV4_0": {"version": "4.0", "baseScore": 5.3, "baseSeverity": "MEDIUM", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:P"}}, {"cvssV3_1": {"version": "3.1", "baseScore": 5.4, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L/E:P/RL:O/RC:C"}}, {"cvssV3_0": {"version": "3.0", "baseScore": 5.4, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L/E:P/RL:O/RC:C"}}, {"cvssV2_0": {"version": "2.0", "baseScore": 5.5, "vectorString": "AV:N/AC:L/Au:S/C:N/I:P/A:P/E:POC/RL:OF/RC:C"}}], "affected": [{"cpes": ["cpe:2.3:a:dolibarr:dolibarr:*:*:*:*:*:*:*:*"], "vendor": "n/a", "modules": ["Account Handler"], "product": "Dolibarr", "versions": [{"status": "affected", "version": "23.0.0"}, {"status": "affected", "version": "23.0.1"}, {"status": "affected", "version": "23.0.2"}, {"status": "affected", "version": "23.0.3"}, {"status": "affected", "version": "23.0.4"}, {"status": "unaffected", "version": "24.0.0"}]}], "timeline": [{"lang": "en", "time": "2026-08-21T00:00:00.000Z", "value": "Advisory disclosed"}, {"lang": "en", "time": "2026-08-21T02:00:00.000Z", "value": "VulDB entry created"}, {"lang": "en", "time": "2026-08-21T07:51:04.000Z", "value": "VulDB entry last update"}], "references": [{"url": "https://vuldb.com/vuln/394034", "name": "VDB-394034 | Dolibarr Account card.php improper authorization", "tags": ["vdb-entry", "technical-description"]}, {"url": "https://vuldb.com/vuln/394034/cti", "name": "VDB-394034 | CTI Indicators (IOB, IOC, TTP, IOA)", "tags": ["signature", "permissions-required"]}, {"url": "https://vuldb.com/cve/CVE-2026-77686", "name": "CVE-2026-77686 | CVE Analysis and Report", "tags": ["third-party-advisory"]}, {"url": "https://vuldb.com/submit/881202", "name": "Submit #881202 | dolibarr software * Privilege Bypass Allows Any User to Delete Admin Accounts", "tags": ["third-party-advisory"]}, {"url": "https://github.com/Dolibarr/dolibarr/issues/39053", "tags": ["exploit", "issue-tracking"]}, {"url": "https://github.com/Dolibarr/dolibarr/pull/39119", "tags": ["issue-tracking", "patch"]}, {"url": "https://github.com/Dolibarr/dolibarr/commit/b2a2c995537cb6282383b5e903cb5ffa29b823e6", "tags": ["patch"]}, {"url": "https://github.com/Dolibarr/dolibarr/releases/tag/24.0.0", "tags": ["patch"]}, {"url": "https://github.com/Dolibarr/dolibarr/", "tags": ["product"]}], "x_generator": ["VulDB PVTS v202608"], "descriptions": [{"lang": "en", "value": "A weakness has been identified in Dolibarr up to 23.0.4. This affects an unknown part of the file htdocs/user/card.php of the component Account Handler. This manipulation of the argument ID causes improper authorization. The attack may be initiated remotely. The exploit has been made available to the public and could be used for attacks. Upgrading to version 24.0.0 is able to mitigate this issue. Patch name: b2a2c995537cb6282383b5e903cb5ffa29b823e6. The affected component should be upgraded."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-285", "description": "Improper Authorization"}]}, {"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-266", "description": "Incorrect Privilege Assignment"}]}], "providerMetadata": {"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "shortName": "VulDB", "dateUpdated": "2026-08-21T11:00:13.604Z"}}}, "cveMetadata": {"cveId": "CVE-2026-77686", "state": "PUBLISHED", "dateUpdated": "2026-08-21T21:44:44.037Z", "dateReserved": "2026-08-21T05:45:58.964Z", "assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "datePublished": "2026-08-21T11:00:13.604Z", "assignerShortName": "VulDB"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"cpes": ["cpe:2.3:a:dolibarr:dolibarr:*:*:*:*:*:*:*:*"], "modules": ["Account Handler"], "product": "Dolibarr", "vendor": "n/a", "versions": [{"status": "affected", "version": "23.0.0"}, {"status": "affected", "version": "23.0.1"}, {"status": "affected", "version": "23.0.2"}, {"status": "affected", "version": "23.0.3"}, {"status": "affected", "version": "23.0.4"}, {"status": "unaffected", "version": "24.0.0"}]}], "source": "cna@vuldb.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "A weakness has been identified in Dolibarr up to 23.0.4. This affects an unknown part of the file htdocs/user/card.php of the component Account Handler. This manipulation of the argument ID causes improper authorization. The attack may be initiated remotely. The exploit has been made available to the public and could be used for attacks. Upgrading to version 24.0.0 is able to mitigate this issue. Patch name: b2a2c995537cb6282383b5e903cb5ffa29b823e6. The affected component should be upgraded."}, {"lang": "es", "value": "Se ha identificado una debilidad en Dolibarr hasta la versi\u00f3n 23.0.4. Esto afecta una parte desconocida del archivo htdocs/user/card.php del componente Gestor de Cuentas. Esta manipulaci\u00f3n del argumento ID causa una autorizaci\u00f3n indebida. El ataque puede iniciarse de forma remota. El exploit se ha puesto a disposici\u00f3n del p\u00fablico y podr\u00eda utilizarse para ataques. La actualizaci\u00f3n a la versi\u00f3n 24.0.0 puede mitigar este problema. Nombre del parche: b2a2c995537cb6282383b5e903cb5ffa29b823e6. El componente afectado deber\u00eda actualizarse."}], "id": "CVE-2026-77686", "lastModified": "2026-10-16T15:10:00.103", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "MEDIUM", "cvssData": {"accessComplexity": "LOW", "accessVector": "NETWORK", "authentication": "SINGLE", "availabilityImpact": "PARTIAL", "baseScore": 5.5, "confidentialityImpact": "NONE", "integrityImpact": "PARTIAL", "vectorString": "AV:N/AC:L/Au:S/C:N/I:P/A:P", "version": "2.0"}, "exploitabilityScore": 8.0, "impactScore": 4.9, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "cna@vuldb.com", "type": "Secondary", "userInteractionRequired": false}], "cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 5.4, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 2.5, "source": "cna@vuldb.com", "type": "Secondary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 2.1, "baseSeverity": "LOW", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "PROOF_OF_CONCEPT", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "LOW", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "LOW", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "LOW", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "cna@vuldb.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-77686", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-08-21T21:40:52.817286Z", "version": "2.0.3"}}]}, "published": "2026-08-21T11:17:06.620", "references": [{"source": "cna@vuldb.com", "url": "https://github.com/Dolibarr/dolibarr/"}, {"source": "cna@vuldb.com", "url": "https://github.com/Dolibarr/dolibarr/commit/b2a2c995537cb6282383b5e903cb5ffa29b823e6"}, {"source": "cna@vuldb.com", "url": "https://github.com/Dolibarr/dolibarr/issues/39053"}, {"source": "cna@vuldb.com", "url": "https://github.com/Dolibarr/dolibarr/pull/39119"}, {"source": "cna@vuldb.com", "url": "https://github.com/Dolibarr/dolibarr/releases/tag/24.0.0"}, {"source": "cna@vuldb.com", "url": "https://vuldb.com/cve/CVE-2026-77686"}, {"source": "cna@vuldb.com", "url": "https://vuldb.com/submit/881202"}, {"source": "cna@vuldb.com", "url": "https://vuldb.com/vuln/394034"}, {"source": "cna@vuldb.com", "url": "https://vuldb.com/vuln/394034/cti"}], "sourceIdentifier": "cna@vuldb.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-266"}, {"lang": "en", "value": "CWE-285"}], "source": "cna@vuldb.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "23.0.0"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "23.0.1"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "23.0.2"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "23.0.3"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "23.0.4"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "24.0.0"}}], "enrichment": {"confidence": 90.0, "confidence_source": "inferred", "scores": [{"score": 90.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Dolibarr", "source": "cna", "vendor": "n/a"}, "product": "dolibarr", "vendor": "dolibarr"}], "created": "2026-08-21T12:45:03.938393+00:00", "updated": "2026-08-21T12:45:04.168166+00:00", "vendors": ["dolibarr", "dolibarr$PRODUCT$dolibarr"]}