CVE-2026-19930

Name of the Vulnerable Software and Affected Versions Dolibarr versions prior to 23.0.4

Description A flaw in the User Cloning component within the file htdocs/user/card.php allows for remote LDAP injection. This occurs through the manipulation of the ID argument. LDAP injection is a technique where malicious input is used to interfere with the queries sent to a Lightweight Directory Access Protocol server, potentially allowing unauthorized access or data retrieval.

Recommendations Apply patch 798e65356ede03c2812ab1a728f23fae34de5592 to resolve the issue. Restrict access to the file htdocs/user/card.php as a temporary mitigation measure.