Dolibarr releases prior to 24.0.0 lack per-object authorization checks in the Users::getGroups REST API endpoint. As a result, any authenticated user can invoke GET /users/{id}/groups with arbitrary identifiers and obtain group membership details, entity associations, and private notes that belong to other users. This allows unauthorized disclosure of potentially sensitive organizational data.

Affected software is Dolibarr ERP/CRM, versions starting at 10.0.0 up to, but not including, 24.0.0. The vulnerability applies to all builds in this range because the authorization check is missing throughout the code base referenced in the commit history.

The reported CVSS score of 5.3 indicates moderate severity. No EPSS data is available, and the vulnerability is not listed in the CISA KEV catalog. Attackers must be authenticated, but the API endpoint accepts any numeric user ID, meaning that a malicious user with valid credentials can enumerate groups of any other user. The vulnerability can be exploited remotely via standard HTTP requests to the affected REST endpoint.