Medium severity · published Aug 24, 2026
CVE-2026-78160
Dolibarr ERP User Notes note.php authorization
6.3
CVSS
0.4%
EPSS
No
On KEV
Description
A vulnerability has been found in Dolibarr ERP up to 18.0.10/22.0.5/23.0.3. This issue affects some unknown processing of the file /user/note.php of the component User Notes Handler. The manipulation of the argument ID leads to authorization bypass. The attack can be initiated remotely. Upgrading to version 23.0.4 and 24.0.0 is capable of addressing this issue. The identifier of the patch is 9b5229ef3a9b58d00252d327936b022fb739f149. Upgrading the affected component is advised.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
Low
Integrity
Low
Availability
Low
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.4% · higher than 33% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
ER
ERP · Dolibarr
18.0.0; 18.0.1; 18.0.2; 18.0.3; 18.0.4; 18.0.5; +15 more · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-78160
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-78160
github.com
https://github.com/Dolibarr/dolibarr/commit/9b5229ef3a9b58d00252d327936b022fb739f149
github.com
https://github.com/Dolibarr/dolibarr/issues/39063
github.com
https://github.com/Dolibarr/dolibarr/pull/39123
github.com
https://github.com/Dolibarr/dolibarr/releases/tag/23.0.4
vuldb.com
https://vuldb.com/cve/CVE-2026-78160
vuldb.com
https://vuldb.com/submit/883067
More from ERP
6.3
CVE-2026-19350
Dolibarr ERP TakePOS invoice.php fail authorization