CVE-2026-77686CWE-266CWE-285

CVE-2026-77686

Medium · published August 21, 2026

CVSS v3.1
5.4
EPSS
0%
Percentile
40.4
In the wild
Unconfirmed
What it is

A weakness has been identified in Dolibarr up to 23.0.4. This affects an unknown part of the file htdocs/user/card.php of the component Account Handler. This manipulation of the argument ID causes improper authorization. The attack may be initiated remotely. The exploit has been made available to the public and could be used for attacks. Upgrading to version 24.0.0 is able to mitigate this issue. Patch name: b2a2c995537cb6282383b5e903cb5ffa29b823e6. The affected component should be upgraded.

The record
Technical detail
CVSS v3.1
5.4 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L
CVSS v4.0
5.3 · CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:P
EPSS
0.00479 · 40.4th percentile
Weaknesses
CWE-266 · Incorrect Privilege Assignment; CWE-285 · Improper Authorization
Published
2026-08-21T15:17Z
References (9)
https://github.com/Dolibarr/dolibarr/ · [email protected]https://github.com/Dolibarr/dolibarr/commit/b2a2c995537cb6282383b5e903cb5ffa29b823e6 · [email protected]https://github.com/Dolibarr/dolibarr/issues/39053 · [email protected]https://github.com/Dolibarr/dolibarr/pull/39119 · [email protected]https://github.com/Dolibarr/dolibarr/releases/tag/24.0.0 · [email protected]https://vuldb.com/cve/CVE-2026-77686 · [email protected]https://vuldb.com/submit/881202 · [email protected]https://vuldb.com/vuln/394034 · [email protected]https://vuldb.com/vuln/394034/cti · [email protected]
EPSS history
Timeline
  • 21 AUG 11:00Z
    Dolibarr Account card.php improper authorization
    cvelistv5