Authorization Bypass in Dolibarr Account Handler

Executive Summary

CVE-2026-77686 is a privilege escalation vulnerability in Dolibarr ERP/CRM affecting versions up to 23.0.4. It allows non-admin users with standard permissions to delete administrator accounts by manipulating the ID parameter in a delete request. The flaw exists in the user/card.php file where the delete action lacks proper admin-status validation, unlike the disable action which correctly blocks non-admin users from disabling admin accounts.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, check Dolibarr versions prior to 24.0.0. Inspect the user/card.php file for missing admin-status validation in delete operations. Look for unusual deletion requests targeting admin accounts by non-admin users.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability enables a low-privileged user to delete the SuperAdmin account, resulting in complete loss of administrative access to the application. Attackers could exploit this to escalate privileges, disrupt operations, or gain unauthorized control over the system.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability allows non-admin users to delete admin accounts, potentially leading to unauthorized access or loss of administrative control. For GDPR, this could result in unauthorized data access or processing if admin accounts are compromised. For HIPAA, unauthorized access to admin functions might violate integrity or confidentiality requirements. The lack of proper authorization checks undermines access control principles required by these standards.

Useful 0 Not Useful 0

Mitigation Strategies

Upgrade Dolibarr to version 24.0.0 or later immediately. Apply the patch from commit b2a2c995537cb6282383b5e903cb5ffa29b823e6 if upgrading is not immediately possible. Review user permissions to ensure non-admin users cannot delete admin accounts.

Useful 0 Not Useful 0