CVE-2026-78160

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-78160", "assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "state": "PUBLISHED", "assignerShortName": "VulDB", "dateReserved": "2026-08-23T11:43:54.013Z", "datePublished": "2026-08-24T00:30:10.986Z", "dateUpdated": "2026-08-24T14:59:25.089Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "shortName": "VulDB", "dateUpdated": "2026-08-24T00:30:10.986Z"}, "title": "Dolibarr ERP User Notes note.php authorization", "problemTypes": [{"descriptions": [{"type": "CWE", "cweId": "CWE-639", "lang": "en", "description": "Authorization Bypass"}]}, {"descriptions": [{"type": "CWE", "cweId": "CWE-285", "lang": "en", "description": "Improper Authorization"}]}], "affected": [{"vendor": "Dolibarr", "product": "ERP", "versions": [{"version": "18.0.0", "status": "affected"}, {"version": "18.0.1", "status": "affected"}, {"version": "18.0.2", "status": "affected"}, {"version": "18.0.3", "status": "affected"}, {"version": "18.0.4", "status": "affected"}, {"version": "18.0.5", "status": "affected"}, {"version": "18.0.6", "status": "affected"}, {"version": "18.0.7", "status": "affected"}, {"version": "18.0.8", "status": "affected"}, {"version": "18.0.9", "status": "affected"}, {"version": "18.0.10", "status": "affected"}, {"version": "22.0.0", "status": "affected"}, {"version": "22.0.1", "status": "affected"}, {"version": "22.0.2", "status": "affected"}, {"version": "22.0.3", "status": "affected"}, {"version": "22.0.4", "status": "affected"}, {"version": "22.0.5", "status": "affected"}, {"version": "23.0.0", "status": "affected"}, {"version": "23.0.1", "status": "affected"}, {"version": "23.0.2", "status": "affected"}, {"version": "23.0.3", "status": "affected"}, {"version": "23.0.4", "status": "unaffected"}, {"version": "24.0.0", "status": "unaffected"}], "cpes": ["cpe:2.3:a:dolibarr:erp:*:*:*:*:*:*:*:*"], "modules": ["User Notes Handler"]}], "descriptions": [{"lang": "en", "value": "A vulnerability has been found in Dolibarr ERP up to 18.0.10/22.0.5/23.0.3. This issue affects some unknown processing of the file /user/note.php of the component User Notes Handler. The manipulation of the argument ID leads to authorization bypass. The attack can be initiated remotely. Upgrading to version 23.0.4 and 24.0.0 is capable of addressing this issue. The identifier of the patch is 9b5229ef3a9b58d00252d327936b022fb739f149. Upgrading the affected component is advised."}], "metrics": [{"cvssV4_0": {"version": "4.0", "baseScore": 5.3, "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P", "baseSeverity": "MEDIUM"}}, {"cvssV3_1": {"version": "3.1", "baseScore": 6.3, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C", "baseSeverity": "MEDIUM"}}, {"cvssV3_0": {"version": "3.0", "baseScore": 6.3, "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C", "baseSeverity": "MEDIUM"}}, {"cvssV2_0": {"version": "2.0", "baseScore": 6.5, "vectorString": "AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:OF/RC:C"}}], "timeline": [{"time": "2026-08-23T00:00:00.000Z", "lang": "en", "value": "Advisory disclosed"}, {"time": "2026-08-23T02:00:00.000Z", "lang": "en", "value": "VulDB entry created"}, {"time": "2026-08-23T13:48:59.000Z", "lang": "en", "value": "VulDB entry last update"}], "credits": [{"lang": "en", "value": "Abderrahmane Aksoum (VulDB User)", "type": "reporter"}], "references": [{"url": "https://vuldb.com/vuln/394542", "name": "VDB-394542 | Dolibarr ERP User Notes note.php authorization", "tags": ["vdb-entry", "technical-description"]}, {"url": "https://vuldb.com/vuln/394542/cti", "name": "VDB-394542 | CTI Indicators (IOB, IOC, IOA)", "tags": ["signature", "permissions-required"]}, {"url": "https://vuldb.com/cve/CVE-2026-78160", "name": "CVE-2026-78160 | CVE Analysis and Report", "tags": ["third-party-advisory"]}, {"url": "https://vuldb.com/submit/883067", "name": "Submit #883067 | dolibarr erp 18.0 User with Self-Edit Rights Can Write to Any Profile(Root + All )", "tags": ["third-party-advisory"]}, {"url": "https://github.com/Dolibarr/dolibarr/issues/39063", "tags": ["issue-tracking"]}, {"url": "https://github.com/Dolibarr/dolibarr/pull/39123", "tags": ["issue-tracking", "patch"]}, {"url": "https://github.com/Dolibarr/dolibarr/commit/9b5229ef3a9b58d00252d327936b022fb739f149", "tags": ["patch"]}, {"url": "https://github.com/Dolibarr/dolibarr/releases/tag/23.0.4", "tags": ["patch"]}], "tags": ["x_open-source"], "x_generator": ["VulDB PVTS v202608"]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-08-24T14:59:16.334698Z", "id": "CVE-2026-78160", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-08-24T14:59:25.089Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-78160", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-08-24T14:59:16.334698Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-08-24T14:59:21.179Z"}}], "cna": {"tags": ["x_open-source"], "title": "Dolibarr ERP User Notes note.php authorization", "credits": [{"lang": "en", "type": "reporter", "value": "Abderrahmane Aksoum (VulDB User)"}], "metrics": [{"cvssV4_0": {"version": "4.0", "baseScore": 5.3, "baseSeverity": "MEDIUM", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P"}}, {"cvssV3_1": {"version": "3.1", "baseScore": 6.3, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C"}}, {"cvssV3_0": {"version": "3.0", "baseScore": 6.3, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C"}}, {"cvssV2_0": {"version": "2.0", "baseScore": 6.5, "vectorString": "AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:OF/RC:C"}}], "affected": [{"cpes": ["cpe:2.3:a:dolibarr:erp:*:*:*:*:*:*:*:*"], "vendor": "Dolibarr", "modules": ["User Notes Handler"], "product": "ERP", "versions": [{"status": "affected", "version": "18.0.0"}, {"status": "affected", "version": "18.0.1"}, {"status": "affected", "version": "18.0.2"}, {"status": "affected", "version": "18.0.3"}, {"status": "affected", "version": "18.0.4"}, {"status": "affected", "version": "18.0.5"}, {"status": "affected", "version": "18.0.6"}, {"status": "affected", "version": "18.0.7"}, {"status": "affected", "version": "18.0.8"}, {"status": "affected", "version": "18.0.9"}, {"status": "affected", "version": "18.0.10"}, {"status": "affected", "version": "22.0.0"}, {"status": "affected", "version": "22.0.1"}, {"status": "affected", "version": "22.0.2"}, {"status": "affected", "version": "22.0.3"}, {"status": "affected", "version": "22.0.4"}, {"status": "affected", "version": "22.0.5"}, {"status": "affected", "version": "23.0.0"}, {"status": "affected", "version": "23.0.1"}, {"status": "affected", "version": "23.0.2"}, {"status": "affected", "version": "23.0.3"}, {"status": "unaffected", "version": "23.0.4"}, {"status": "unaffected", "version": "24.0.0"}]}], "timeline": [{"lang": "en", "time": "2026-08-23T00:00:00.000Z", "value": "Advisory disclosed"}, {"lang": "en", "time": "2026-08-23T02:00:00.000Z", "value": "VulDB entry created"}, {"lang": "en", "time": "2026-08-23T13:48:59.000Z", "value": "VulDB entry last update"}], "references": [{"url": "https://vuldb.com/vuln/394542", "name": "VDB-394542 | Dolibarr ERP User Notes note.php authorization", "tags": ["vdb-entry", "technical-description"]}, {"url": "https://vuldb.com/vuln/394542/cti", "name": "VDB-394542 | CTI Indicators (IOB, IOC, IOA)", "tags": ["signature", "permissions-required"]}, {"url": "https://vuldb.com/cve/CVE-2026-78160", "name": "CVE-2026-78160 | CVE Analysis and Report", "tags": ["third-party-advisory"]}, {"url": "https://vuldb.com/submit/883067", "name": "Submit #883067 | dolibarr erp 18.0 User with Self-Edit Rights Can Write to Any Profile(Root + All )", "tags": ["third-party-advisory"]}, {"url": "https://github.com/Dolibarr/dolibarr/issues/39063", "tags": ["issue-tracking"]}, {"url": "https://github.com/Dolibarr/dolibarr/pull/39123", "tags": ["issue-tracking", "patch"]}, {"url": "https://github.com/Dolibarr/dolibarr/commit/9b5229ef3a9b58d00252d327936b022fb739f149", "tags": ["patch"]}, {"url": "https://github.com/Dolibarr/dolibarr/releases/tag/23.0.4", "tags": ["patch"]}], "x_generator": ["VulDB PVTS v202608"], "descriptions": [{"lang": "en", "value": "A vulnerability has been found in Dolibarr ERP up to 18.0.10/22.0.5/23.0.3. This issue affects some unknown processing of the file /user/note.php of the component User Notes Handler. The manipulation of the argument ID leads to authorization bypass. The attack can be initiated remotely. Upgrading to version 23.0.4 and 24.0.0 is capable of addressing this issue. The identifier of the patch is 9b5229ef3a9b58d00252d327936b022fb739f149. Upgrading the affected component is advised."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-639", "description": "Authorization Bypass"}]}, {"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-285", "description": "Improper Authorization"}]}], "providerMetadata": {"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "shortName": "VulDB", "dateUpdated": "2026-08-24T00:30:10.986Z"}}}, "cveMetadata": {"cveId": "CVE-2026-78160", "state": "PUBLISHED", "dateUpdated": "2026-08-24T14:59:25.089Z", "dateReserved": "2026-08-23T11:43:54.013Z", "assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "datePublished": "2026-08-24T00:30:10.986Z", "assignerShortName": "VulDB"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"cpes": ["cpe:2.3:a:dolibarr:erp:*:*:*:*:*:*:*:*"], "modules": ["User Notes Handler"], "product": "ERP", "vendor": "Dolibarr", "versions": [{"status": "affected", "version": "18.0.0"}, {"status": "affected", "version": "18.0.1"}, {"status": "affected", "version": "18.0.2"}, {"status": "affected", "version": "18.0.3"}, {"status": "affected", "version": "18.0.4"}, {"status": "affected", "version": "18.0.5"}, {"status": "affected", "version": "18.0.6"}, {"status": "affected", "version": "18.0.7"}, {"status": "affected", "version": "18.0.8"}, {"status": "affected", "version": "18.0.9"}, {"status": "affected", "version": "18.0.10"}, {"status": "affected", "version": "22.0.0"}, {"status": "affected", "version": "22.0.1"}, {"status": "affected", "version": "22.0.2"}, {"status": "affected", "version": "22.0.3"}, {"status": "affected", "version": "22.0.4"}, {"status": "affected", "version": "22.0.5"}, {"status": "affected", "version": "23.0.0"}, {"status": "affected", "version": "23.0.1"}, {"status": "affected", "version": "23.0.2"}, {"status": "affected", "version": "23.0.3"}, {"status": "unaffected", "version": "23.0.4"}, {"status": "unaffected", "version": "24.0.0"}]}], "source": "cna@vuldb.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "A vulnerability has been found in Dolibarr ERP up to 18.0.10/22.0.5/23.0.3. This issue affects some unknown processing of the file /user/note.php of the component User Notes Handler. The manipulation of the argument ID leads to authorization bypass. The attack can be initiated remotely. Upgrading to version 23.0.4 and 24.0.0 is capable of addressing this issue. The identifier of the patch is 9b5229ef3a9b58d00252d327936b022fb739f149. Upgrading the affected component is advised."}, {"lang": "es", "value": "Una vulnerabilidad ha sido encontrada en Dolibarr ERP hasta 18.0.10/22.0.5/23.0.3. Este problema afecta a un procesamiento desconocido del archivo /user/note.php del componente Gestor de Notas de Usuario. La manipulaci\u00f3n del argumento ID lleva a una omisi\u00f3n de autorizaci\u00f3n. El ataque puede ser iniciado remotamente. La actualizaci\u00f3n a la versi\u00f3n 23.0.4 y 24.0.0 es capaz de solucionar este problema. El identificador del parche es 9b5229ef3a9b58d00252d327936b022fb739f149. Se aconseja actualizar el componente afectado."}], "id": "CVE-2026-78160", "lastModified": "2026-10-12T16:10:00.220", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "MEDIUM", "cvssData": {"accessComplexity": "LOW", "accessVector": "NETWORK", "authentication": "SINGLE", "availabilityImpact": "PARTIAL", "baseScore": 6.5, "confidentialityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "vectorString": "AV:N/AC:L/Au:S/C:P/I:P/A:P", "version": "2.0"}, "exploitabilityScore": 8.0, "impactScore": 6.4, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "cna@vuldb.com", "type": "Secondary", "userInteractionRequired": false}], "cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 6.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 3.4, "source": "cna@vuldb.com", "type": "Secondary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 2.1, "baseSeverity": "LOW", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "PROOF_OF_CONCEPT", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "LOW", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "LOW", "vulnConfidentialityImpact": "LOW", "vulnIntegrityImpact": "LOW", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "cna@vuldb.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-78160", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-08-24T14:59:16.334698Z", "version": "2.0.3"}}]}, "published": "2026-08-24T01:16:57.180", "references": [{"source": "cna@vuldb.com", "url": "https://github.com/Dolibarr/dolibarr/commit/9b5229ef3a9b58d00252d327936b022fb739f149"}, {"source": "cna@vuldb.com", "url": "https://github.com/Dolibarr/dolibarr/issues/39063"}, {"source": "cna@vuldb.com", "url": "https://github.com/Dolibarr/dolibarr/pull/39123"}, {"source": "cna@vuldb.com", "url": "https://github.com/Dolibarr/dolibarr/releases/tag/23.0.4"}, {"source": "cna@vuldb.com", "url": "https://vuldb.com/cve/CVE-2026-78160"}, {"source": "cna@vuldb.com", "url": "https://vuldb.com/submit/883067"}, {"source": "cna@vuldb.com", "url": "https://vuldb.com/vuln/394542"}, {"source": "cna@vuldb.com", "url": "https://vuldb.com/vuln/394542/cti"}], "sourceIdentifier": "cna@vuldb.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-285"}, {"lang": "en", "value": "CWE-639"}], "source": "cna@vuldb.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "18.0.0"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "18.0.1"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "18.0.2"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "18.0.3"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "18.0.4"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "18.0.5"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "18.0.6"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "18.0.7"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "18.0.8"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "18.0.9"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "18.0.10"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "22.0.0"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "22.0.1"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "22.0.2"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "22.0.3"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "22.0.4"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "22.0.5"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "23.0.0"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "23.0.1"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "23.0.2"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "23.0.3"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "23.0.4"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "24.0.0"}}], "enrichment": {"confidence": 95.0, "confidence_source": "inferred", "scores": [{"score": 95.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "ERP", "source": "cna", "vendor": "Dolibarr"}, "product": "erp", "vendor": "dolibarr"}], "created": "2026-08-24T01:30:04.792513+00:00", "updated": "2026-08-24T03:30:04.908319+00:00", "vendors": ["dolibarr", "dolibarr$PRODUCT$erp"]}