CVE-2026-77686
Dolibarr Account card.php improper authorization
Description
A weakness has been identified in Dolibarr up to 23.0.4. This affects an unknown part of the file htdocs/user/card.php of the component Account Handler. This manipulation of the argument ID causes improper authorization. The attack may be initiated remotely. The exploit has been made available to the public and could be used for attacks. Upgrading to version 24.0.0 is able to mitigate this issue. Patch name: b2a2c995537cb6282383b5e903cb5ffa29b823e6. The affected component should be upgraded.
INFO
Published Date :
Aug. 21, 2026, 11:17 a.m.
Last Modified :
Aug. 24, 2026, 4:41 p.m.
Remotely Exploit :
Yes !
Source :
[email protected]
CVSS Scores
| Score | Version | Severity | Vector | Exploitability Score | Impact Score | Source |
|---|---|---|---|---|---|---|
| CVSS | 134c704f-9b21-4f2e-91b3-4a467353bcc0 | |||||
| CVSS 2.0 | MEDIUM | [email protected] | ||||
| CVSS 3.1 | MEDIUM | [email protected] | ||||
| CVSS 4.0 | LOW | [email protected] |
Solution
- Upgrade Dolibarr to version 24.0.0 or later.
- Apply the provided patch.
- Ensure the Account Handler component is updated.
References to Advisories, Solutions, and Tools
Here, you will find a curated list of external links that provide in-depth
information, practical solutions, and valuable tools related to
CVE-2026-77686.
CWE - Common Weakness Enumeration
While CVE identifies
specific instances of vulnerabilities, CWE categorizes the common flaws or
weaknesses that can lead to vulnerabilities. CVE-2026-77686 is
associated with the following CWEs:
Common Attack Pattern Enumeration and Classification (CAPEC)
Common Attack Pattern Enumeration and Classification
(CAPEC)
stores attack patterns, which are descriptions of the common attributes and
approaches employed by adversaries to exploit the CVE-2026-77686
weaknesses.
We scan GitHub repositories to detect new proof-of-concept exploits. Following list is a collection of public exploits and proof-of-concepts, which have been published on GitHub (sorted by the most recently updated).
Results are limited to the first 15 repositories due to potential performance issues.
The following list is the news that have been mention
CVE-2026-77686 vulnerability anywhere in the article.
The following table lists the changes that have been made to the
CVE-2026-77686 vulnerability over time.
Vulnerability history details can be useful for understanding the evolution of a vulnerability, and for identifying the most recent changes that may impact the vulnerability's severity, exploitability, or other characteristics.
-
CVE Modified by 134c704f-9b21-4f2e-91b3-4a467353bcc0
Aug. 21, 2026
Action Type Old Value New Value Added SSVC {'id': 'CVE-2026-77686', 'role': 'CISA Coordinator', 'options': [{'exploitation': 'poc'}, {'automatable': 'no'}, {'technicalImpact': 'partial'}], 'version': '2.0.3', 'timestamp': '2026-08-21T21:40:52.817286Z'} -
New CVE Received by [email protected]
Aug. 21, 2026
Action Type Old Value New Value Added Affected [{'cpes': ['cpe:2.3:a:dolibarr:dolibarr:*:*:*:*:*:*:*:*'], 'vendor': 'n/a', 'modules': ['Account Handler'], 'product': 'Dolibarr', 'versions': [{'status': 'affected', 'version': '23.0.0'}, {'status': 'affected', 'version': '23.0.1'}, {'status': 'affected', 'version': '23.0.2'}, {'status': 'affected', 'version': '23.0.3'}, {'status': 'affected', 'version': '23.0.4'}, {'status': 'unaffected', 'version': '24.0.0'}]}] Added Description A weakness has been identified in Dolibarr up to 23.0.4. This affects an unknown part of the file htdocs/user/card.php of the component Account Handler. This manipulation of the argument ID causes improper authorization. The attack may be initiated remotely. The exploit has been made available to the public and could be used for attacks. Upgrading to version 24.0.0 is able to mitigate this issue. Patch name: b2a2c995537cb6282383b5e903cb5ffa29b823e6. The affected component should be upgraded. Added CVSS V4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Added CVSS V3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L Added CVSS V2 (AV:N/AC:L/Au:S/C:N/I:P/A:P) Added CWE CWE-285 Added CWE CWE-266 Added Reference https://github.com/Dolibarr/dolibarr/ Added Reference https://github.com/Dolibarr/dolibarr/commit/b2a2c995537cb6282383b5e903cb5ffa29b823e6 Added Reference https://github.com/Dolibarr/dolibarr/issues/39053 Added Reference https://github.com/Dolibarr/dolibarr/pull/39119 Added Reference https://github.com/Dolibarr/dolibarr/releases/tag/24.0.0 Added Reference https://vuldb.com/cve/CVE-2026-77686 Added Reference https://vuldb.com/submit/881202 Added Reference https://vuldb.com/vuln/394034 Added Reference https://vuldb.com/vuln/394034/cti