CyberRota Analysis
AI-GeneratedDolibarr versions prior to 24.0.0 are vulnerable due to insufficient authorization checks in the Users::getGroups REST API, enabling authenticated users to access group memberships of other users by manipulating user identifiers. This flaw allows attackers to retrieve sensitive information, including group names and private notes, potentially leading to data exposure across tenant boundaries. Organizations using affected Dolibarr versions should prioritize patching to mitigate the risk of unauthorized data access.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Dolibarr versions 10.0.0 before 24.0.0 fail to perform per-object authorization checks in the Users::getGroups REST API endpoint, allowing authenticated users to retrieve group memberships of other users. Attackers can call GET /users/{id}/groups with arbitrary user identifiers to access group names, entity associations, and private notes across tenant boundaries.