This vulnerability in Dolibarr up to version 23.0.4 allows remote attackers to exploit improper authorization in the Account Handler component by manipulating the ID argument in htdocs/user/card.php. This can lead to unauthorized access or actions due to insufficient authorization checks. The issue is fixed in version 24.0.0, with a patch identified by commit b2a2c995537cb6282383b5e903cb5ffa29b823e6. Public exploit code exists, but no known active exploitation in the wild has been reported.

The vulnerability enables remote attackers to bypass authorization controls, potentially allowing unauthorized access or modification of user account information within Dolibarr. The CVSS 4.0 base score is 5.3 (medium), reflecting network attack vector, low attack complexity, no user interaction, and limited impact on confidentiality, integrity, and availability.

Upgrade Dolibarr to version 24.0.0 or later, which contains the official fix for this improper authorization vulnerability. No other mitigation or temporary workaround is indicated. Since the vulnerability is patched in the new version, applying this upgrade is the recommended remediation.