A vulnerability in Dolibarr’s account handling module allows an attacker to tamper with the ID parameter in the /user/card.php script, bypassing standard access controls. This improper authorization can lead to unauthorized viewing or manipulation of user account information, as the system fails to correctly verify the requester’s privileges. The weakness maps to CWE‑266 (Privilege Escalation) and CWE‑285 (Improper Access Control).

The issue exists in Dolibarr versions up to 23.0.4. Vulnerable code resides in the file htdocs/user/card.php within the Account Handler component. Versions 24.0.0 and later contain the fix and are not affected. All deployments of Dolibarr running legacy releases should be considered at risk unless upgraded.

The CVSS score of 5.3 indicates a moderate severity. EPSS data is unavailable, and the vulnerability is not listed in CISA’s KEV catalog. The attack vector is likely remote, accessed through a web request, as the exploit can be triggered from outside the host. Because the exploit has been made publicly available, administrators should treat this as a realistic threat if their systems remain unpatched.