TI-2021-07962 Aliases CVE-2021-25956 GHSA-fjqg-w8g6-hhq8

Improper User Access Control in "Dolibarr" Leads to Account Takeover

LOW 33CWE-284Published 2021-08-17 · Updated 2024-09-16

Key facts

Attack vector: Network
Privileges required: High
User interaction: None
Attack complexity: Low
Impact type: Security bypass
Confidentiality · integrity · availability: High · High · High
Fix status: Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA and GitHub. Impact type from CWE-284.

Summary

In “Dolibarr” application, v3.3.beta1_20121221 to v13.0.2 have “Modify” access for admin level users to change other user’s details but fails to validate already existing “Login” name, while renaming the user “Login”. This leads to complete account takeover of the victim user. This happens since the password gets overwritten for the victim user having a similar login name.

Why it matters now

EPSS 0.00935 61st percentileScored 2026-11-07

Fix Fixed dolibarr/dolibarr (Packagist): 14.0.0

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
Dolibarr	dolibarr	3.3.beta1_20121221 and later	—	No fix listed	CNA
—	dolibarr/dolibarr (Packagist)	3.3.beta1 to before 14.0.0	14.0.0	Patch available	GHSA-fjqg-w8g6-hhq8

dolibarr VendorDolibarr Affected 3.3.beta1_20121221 and later Fixed in — No fix listed CNA
dolibarr/dolibarr (Packagist) Vendor— Affected 3.3.beta1 to before 14.0.0 Fixed in 14.0.0 Patch available GHSA-fjqg-w8g6-hhq8

CPE configurations NVD · 3

CPE	Versions	Role	Vendor
cpe:2.3:a:dolibarr:dolibarr::::::::	3.3.1 – 13.0.2	Vulnerable	Dolibarr
cpe:2.3:a:dolibarr:dolibarr_erp\/crm:3.3.0:beta1::::::	3.3.0 beta1	Vulnerable	Dolibarr
cpe:2.3:a:dolibarr:dolibarr_erp\/crm:3.3.0:beta2::::::	3.3.0 beta2	Vulnerable	Dolibarr

cpe:2.3:a:dolibarr:dolibarr:*:*:*:*:*:*:*:* Versions 3.3.1 – 13.0.2 Vulnerable ·Dolibarr
cpe:2.3:a:dolibarr:dolibarr_erp\/crm:3.3.0:beta1:*:*:*:*:*:* Versions 3.3.0 beta1 Vulnerable ·Dolibarr
cpe:2.3:a:dolibarr:dolibarr_erp\/crm:3.3.0:beta2:*:*:*:*:*:* Versions 3.3.0 beta2 Vulnerable ·Dolibarr

Remediation

Fix · GHSA-fjqg-w8g6-hhq8 dolibarr/dolibarr (Packagist) Fixed in 14.0.0 Advisory →

Timeline

2026-10-02 Threatist record created from CVE-2021-25956
2026-10-03 Alias added: GHSA-fjqg-w8g6-hhq8

References

Patch 1

https://github.com/Dolibarr/dolibarr/commit/c4cba43bade736ab89e31013a6ccee59a6e077ee

Advisory 2

Other 1

https://github.com/Dolibarr/dolibarr

TI-2018-07157 SQL injection vulnerability in Dolibarr before 7.0.2 allows remote attackers to execute… CVSS 3.0CRITICAL 9.8
TI-2018-07158 Cross-site scripting (XSS) vulnerability in Dolibarr before 7.0.2 allows remote attackers… CVSS 3.0MEDIUM 6.1
TI-2020-11130 Dolibarr before 11.0.5 allows low-privilege users to upload files of dangerous types… CVSS 3.1HIGH 8.8
TI-2019-13844 Dolibarr ERP/CRM 3.0 through 10.0.3 allows XSS via the qty parameter to product/fournisseurs.php (product price screen). CVSS 3.1CRITICAL 9.8
TI-2018-06539 SQL Injection vulnerability in Dolibarr before version 7.0.2 allows remote attackers to… CVSS 3.1CRITICAL 9.8
TI-2018-12038 An issue was discovered in Dolibarr through 7.0.0. CVSS 3.0CRITICAL 9.8

See all 31 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences