CVE-2026-78160

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-78160
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-78160.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-78160
Published
2026-08-24T00:30:10.986Z
Modified
2026-08-25T04:02:52.982926239Z
Severity
  • 2.1 (Low) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P CVSS Calculator
Summary
Dolibarr ERP User Notes note.php authorization
Details

A vulnerability has been found in Dolibarr ERP up to 18.0.10/22.0.5/23.0.3. This issue affects some unknown processing of the file /user/note.php of the component User Notes Handler. The manipulation of the argument ID leads to authorization bypass. The attack can be initiated remotely. Upgrading to version 23.0.4 and 24.0.0 is capable of addressing this issue. The identifier of the patch is 9b5229ef3a9b58d00252d327936b022fb739f149. Upgrading the affected component is advised.

Database specific 
{
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/78xxx/CVE-2026-78160.json",
    "cwe_ids": [
        "CWE-285",
        "CWE-639"
    ],
    "cna_assigner": "VulDB"
}
References

Affected packages

Git / github.com/dolibarr/dolibarr

Affected ranges

Type
GIT
Repo
https://github.com/dolibarr/dolibarr
Events
Introduced
126634229f389b7e49c3c64d86d483f6dc77390b
Fixed
9b5229ef3a9b58d00252d327936b022fb739f149
Fixed
cb82037066c1c71f7c867482e9e92975222dfc14
Database specific
Show details 
{
    "extracted_events": [
        {
            "introduced": "18.0.0"
        },
        {
            "last_affected": "18.0.0"
        },
        {
            "introduced": "18.0.1"
        },
        {
            "last_affected": "18.0.1"
        },
        {
            "introduced": "18.0.2"
        },
        {
            "last_affected": "18.0.2"
        },
        {
            "introduced": "18.0.3"
        },
        {
            "last_affected": "18.0.3"
        },
        {
            "introduced": "18.0.4"
        },
        {
            "last_affected": "18.0.4"
        },
        {
            "introduced": "18.0.5"
        },
        {
            "last_affected": "18.0.5"
        },
        {
            "introduced": "18.0.6"
        },
        {
            "last_affected": "18.0.6"
        },
        {
            "introduced": "18.0.7"
        },
        {
            "last_affected": "18.0.7"
        },
        {
            "introduced": "18.0.8"
        },
        {
            "last_affected": "18.0.8"
        },
        {
            "introduced": "18.0.9"
        },
        {
            "last_affected": "18.0.9"
        },
        {
            "introduced": "18.0.10"
        },
        {
            "last_affected": "18.0.10"
        },
        {
            "introduced": "22.0.0"
        },
        {
            "last_affected": "22.0.0"
        },
        {
            "introduced": "22.0.1"
        },
        {
            "last_affected": "22.0.1"
        },
        {
            "introduced": "22.0.2"
        },
        {
            "last_affected": "22.0.2"
        },
        {
            "introduced": "22.0.3"
        },
        {
            "last_affected": "22.0.3"
        },
        {
            "introduced": "22.0.4"
        },
        {
            "last_affected": "22.0.4"
        },
        {
            "introduced": "22.0.5"
        },
        {
            "last_affected": "22.0.5"
        },
        {
            "introduced": "23.0.0"
        },
        {
            "last_affected": "23.0.0"
        },
        {
            "introduced": "23.0.1"
        },
        {
            "last_affected": "23.0.1"
        },
        {
            "introduced": "23.0.2"
        },
        {
            "last_affected": "23.0.2"
        },
        {
            "introduced": "23.0.3"
        },
        {
            "last_affected": "23.0.3"
        }
    ],
    "source": [
        "AFFECTED_FIELD",
        "REFERENCES"
    ]
}

Affected versions

18.*
18.0.0
18.0.1
18.0.10
18.0.2
18.0.3
18.0.4
18.0.5
18.0.6
18.0.7
18.0.8
18.0.9
22.*
22.0.0
22.0.1
22.0.2
22.0.3
22.0.4
22.0.5
23.*
23.0.0
23.0.1
23.0.2
23.0.3

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-78160.json"