CVE-2026-77686

CVE-2026-77686 is an IDOR in Dolibarr's user account management (user/card.php) allowing unauthorized users to access or modify account details by manipulating the user ID parameter. The remediation is upgrading to version 24.0.0, but the key question for defenders is whether this fix represents a framework-level hardening or a localized authorization gate added only to this component. If the underlying commit shows a targeted check added only to user/card.php, the pattern almost certainly persists in other entity cards—contract, invoice, thirdparty, and similar components following Dolibarr's card.php retrieval-by-ID template. In an ERP system like Dolibarr, this matters beyond a single object: user cards are nodes in an authorization graph that gates access to employees, third-parties, contracts, and financial data. An IDOR here isn't just reading a name and email—it's potentially enumerating user IDs to probe which accounts have payroll access or link to suppliers with outstanding invoices. The blast radius is the entire permission graph, not isolated records. Defenders should assume other card.php files contain the same oversight until proven otherwise. Prioritize auditing invoice and contract card components first—they sit at the intersection of financial data and Dolibarr's permission hierarchy, making them higher-value targets for enumeration. Check whether your deployment runs custom modules or third-party plugins that may reference older retrieval patterns; these can bypass any new authorization gates added to core files. The exposure window matters: enterprise deployments rarely upgrade mid-fiscal-year for medium-severity CVEs, meaning the gap between disclosure and full remediation across the installed base creates a period where sophisticated attackers can weaponize this pattern against adjacent components. Assume additional findings in this family will surface and treat them as interconnected rather than isolated incidents.

Reviewed through automated stages and approved by a human before publication.