Dolibarr versions 10.0.0 before 24.0.0 fail to perform per-object authorization checks in the Users::getGroups REST API endpoint, allowing… (CVE-2026-82633)

Dolibarr versions 10.0.0 before 24.0.0 fail to enforce per-object authorization checks in the Users::getGroups REST API endpoint. As a result, authenticated users can access group membership information of other users by invoking the GET /users/{id}/groups endpoint with arbitrary user identifiers. This leads to unauthorized disclosure of group names, entity associations, and private notes that may cross tenant boundaries. The vulnerability is classified under CWE-862 (Missing Authorization).

The vulnerability allows an authenticated user to access sensitive information about other users' group memberships, including group names, entity associations, and private notes. This unauthorized information disclosure could lead to privacy violations and potential information leakage across tenant boundaries. The CVSS score is 4.3 (medium severity), indicating limited confidentiality impact with no integrity or availability impact.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the Users::getGroups REST API endpoint to trusted users only and monitor API usage for suspicious activity related to unauthorized group membership queries.