Description
Dolibarr versions 10.0.0 before 24.0.0 fail to perform per-object authorization checks in the Users::getGroups REST API endpoint, allowing authenticated users to retrieve group memberships of other users. Attackers can call GET /users/{id}/groups with arbitrary user identifiers to access group names, entity associations, and private notes across tenant boundaries.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
Dolibarr dolibarr
Default version status: unaffected
10.0.0 to < 24.0.0affected
pkg:github/Dolibarr/dolibarrReferences
- https://github.com/Dolibarr/dolibarr/commit/fd478850f823e27c672300acb4b02baeef79aef1 ↗
- https://github.com/Dolibarr/dolibarr/blob/23.0.4/htdocs/user/class/api_users.class.php ↗
- https://github.com/Dolibarr/dolibarr/releases/tag/24.0.0 ↗
- https://github.com/Dolibarr/dolibarr ↗
- https://www.vulncheck.com/advisories/dolibarr-10.0.0-before-24.0.0-missing-authorization-on-rest-users-groups-endpoint ↗