The CVSS 6.3 score for this IDOR-based authorization bypass in Dolibarr almost certainly understates the actual risk profile in an ERP/CRM context. The vulnerability allows a low-privileged user to read another user's notes by manipulating the note ID parameter — a horizontal privilege escalation that horizontal privilege escalation that crosses access tiers rather than elevating privileges within a single tier.
The cross-version persistence of this flaw across branches 18.x, 22.x, and 23.x demands architectural scrutiny rather than treating it as a simple input validation bug. The IDOR pattern — manipulating an ID argument to access objects outside your authorization scope — is the operational signature of Insecure Direct Object Reference, and this classification carries weight that the CVSS formula obscures. First, IDOR flaws are rarely isolated; they indicate a systemic failure to enforce object-level access controls, meaning the same pattern likely exists elsewhere in Dolibarr's codebase. The patch addresses the symptom, not necessarily the underlying access control architecture. Second, in an ERP system, User Notes are not trivial metadata — they contain customer context, deal terms, internal assessments, and other sensitive business intelligence. Horizontal leakage through note access could expose competitive or legally sensitive information with regulatory implications under GDPR or similar frameworks.
Audit guidance: treat this CVE as cartography, not just cartography — it maps the shape of what's possible, not just what's been found. Review Dolibarr's other handlers (contacts, contracts, projects, third parties) for similar IDOR patterns. If the development model shows only per-handler patches with no framework-level authorization contract, expect additional CVEs in untested handlers within the next release cycle. Organizations on branch 18.x should treat this as evidence of the vulnerability class, not just this instance — long-tail branch support means the underlying pattern may persist in handlers that won't receive systematic audit coverage.