CVE-2026-82633: Dolibarr

Medium severity, CVSS 4.3. EPSS: 0.3% chance of exploitation in the next 30 days.

Dolibarr versions 10.0.0 before 24.0.0 fail to perform per-object authorization checks in the Users::getGroups REST API endpoint, allowing authenticated users to retrieve group memberships of other users. Attackers can call GET /users/{id}/groups with arbitrary user identifiers to access group names, entity associations, and private notes across tenant boundaries.

Affected products

• Dolibarr Dolibarr: from 10.0.0, before 24.0.0 (fixed in 24.0.0)

Published 2026-08-30. Last modified 2026-09-10.