CVE-2026-82633 Dolibarr CVE debrief

Who should care

Administrators and users of Dolibarr installations, particularly those using versions 10.0.0 before 24.0.0, should be aware of this vulnerability and take necessary actions to mitigate it. They should review and update their installations, restrict access to the affected endpoint, and monitor for suspicious activity. Additionally, security teams and vulnerability management teams should prioritize patching and compensating controls for exposed systems while remediation is scheduled and verified. Operators of affected platforms should also review the official advisory and CVE record to validate affected scope, severity, and vendor guidance. This vulnerability may impact operators who rely on Dolibarr for user management and group access control, and they should plan vendor-supported updates or mitigations through normal change control where exposure is confirmed. Compensating controls for exposed systems should be reviewed while remediation is scheduled and verified. Relevant monitoring, detection, and logs for exposed assets that need extra review should be checked. Exceptions, retest remediated assets, and close the item only after evidence is documented. The CVE record and NVD entry provide details about the vulnerability in Dolibarr versions 10.0.0 before 24.0.0. However, further information about the vulnerability's impact and affected configurations is limited. Dolibarr versions 10.0.0 before 24.0.0 have a vulnerability in the Users::getGroups REST API endpoint. The vulnerability allows authenticated users to retrieve group memberships of other users by calling GET /users/{id}/groups with arbitrary user identifiers. This access can reveal group names, entity associations, and private notes across tenant boundaries. The vulnerability in Dolibarr versions 10.0.0 before 24.0.0 is due to a lack of per-object authorization checks in the Users::getGroups REST API endpoint. This allows authenticated users to call GET /users/{id}/groups with arbitrary user identifiers, potentially accessing group names, entity associations, and private notes across tenant boundaries. The affected product deployments should be reviewed for exposure, and defenders should verify the  

Technical summary

The vulnerability in Dolibarr versions 10.0.0 before 24.0.0 is due to a lack of per-object authorization checks in the Users::getGroups REST API endpoint. This allows authenticated users to call GET /users/{id}/groups with arbitrary user identifiers, potentially accessing group names, entity associations, and private notes across tenant boundaries. The affected product deployments should be reviewed for exposure, and defenders should verify the impact on their specific configurations.

Defensive priority

Authenticated users could exploit this vulnerability to access sensitive group membership information across tenant boundaries.

Recommended defensive actions

• Review and update Dolibarr installations to version 24.0.0 or later
• Restrict access to the Users::getGroups REST API endpoint
• Monitor for suspicious activity on the affected endpoint
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed.
• Review compensating controls for exposed systems while remediation is scheduled and verified.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.

Evidence notes

The CVE record and NVD entry provide details about the vulnerability in Dolibarr versions 10.0.0 before 24.0.0. However, further information about the vulnerability's impact and affected configurations is limited.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.