This vulnerability in Dolibarr ERP involves an authorization bypass caused by improper processing of the ID argument in the User Notes Handler component located at /user/note.php. The flaw allows remote attackers to bypass authorization checks, potentially accessing or manipulating user notes without proper permissions. The vulnerability affects multiple versions up to 18.0.10, 22.0.5, and 23.0.3. The issue is resolved by upgrading to versions 23.0.4 or 24.0.0, with the patch identified by commit 9b5229ef3a9b58d00252d327936b022fb739f149.

The vulnerability enables remote attackers with low privileges to bypass authorization controls in the affected Dolibarr ERP versions, potentially leading to unauthorized access or modification of user notes. The CVSS 4.0 base score is 5.3 (medium severity), reflecting network attack vector, low attack complexity, no user interaction, and limited confidentiality, integrity, and availability impacts.

A fix is available by upgrading Dolibarr ERP to version 23.0.4 or 24.0.0. Users of affected versions should apply these updates promptly to remediate the authorization bypass vulnerability. No additional mitigation steps are indicated by the vendor advisory.