CVE-2021-3991

What it actually does

Allows users with restricted 'Reception' permissions to bypass authorization checks and retrieve detailed reception records by directly accessing specific URLs.

Why it matters to the business

Enables unauthorized internal users to view sensitive business reception data, raising risks of information leakage, operational exposure, and compliance violations across deployments using older Dolibarr versions.

How an attack unfolds

An attacker authenticates with a low-privileged account limited in the Reception section, identifies valid reception identifiers through enumeration or prior knowledge, and issues direct HTTP requests to the detail endpoints to retrieve records that permission checks should have blocked.

How to fix it

Upgrade Dolibarr to version 15.0.0 or later by applying the fix from commit 63cd06394f39d60784d6e6a0ccf4867a71a6568f; after upgrade, review and tighten Reception module permissions for all users.

How to confirm the fix worked

Confirm the running Dolibarr version is 15.0.0 or newer; log in with a restricted Reception account and verify that direct URL access to reception details now returns an authorization error instead of data.

Typical attack path

1. Obtain or compromise a Dolibarr account with intentionally restricted Reception module permissions
2. Enumerate or predict valid reception record identifiers
3. Craft and send direct HTTP GET requests to the reception detail URLs
4. Parse and exfiltrate the returned sensitive reception information

How to detect it

Examine web server and Dolibarr application logs for HTTP requests to reception detail endpoints originating from accounts whose session tokens or permission profiles indicate restricted Reception access; correlate timestamps with user activity to identify bypass attempts.

• /reception/card.php?id=
• /reception/document.php
• reception/detail access without module permission grant

What your security team should do

• Prioritize upgrade to the fixed commit or 15.0.0+ within the next maintenance window due to the 706-day exposure window
• Audit all Reception module permission assignments and revoke unnecessary access
• Enable detailed application logging for URL requests to reception endpoints
• Add web application firewall rules to detect anomalous direct access patterns to reception resources