Read the docs
TI-2026-50108 Aliases CVE-2026-71505GHSA-c275-q2j8-wwg9

Dolibarr < 24.0.0 REST API Broken Object-Level Authorization via Third-Party Write Route

Priority MEDIUM 64CWE-639Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
Security bypass
Confidentiality · integrity · availability
Low · High · None
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-639.

Summary

Dolibarr before 24.0.0 contains a broken object-level authorization vulnerability in the REST API third-party site account write routes that allows authenticated attackers with third-party creation rights to overwrite the WebPortal password of any company by bypassing per-object access checks that are only enforced on read routes. Attackers can replace the victim company's WebPortal password through the write endpoint, authenticate as that company to access its invoice data, and also obtain the victim's previous password verifier from the API response.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.0041 35th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by the CNA
Fix Fixed dolibarr (Dolibarr): 24.0.0

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
Dolibarrdolibarrbefore 24.0.024.0.0Patch availableCNA
  • dolibarr VendorDolibarr Affected before 24.0.0 Fixed in 24.0.0 Patch available CNA

Remediation

  • Fix · CNA dolibarr (Dolibarr) Fixed in 24.0.0

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Release ·

    dolibarr 24.0.0

    10 records Highest priority Priority HIGH 2 HIGH, 7 MEDIUM, 1 LOW

    Other records, highest priority first

    • TI-2026-50107 Dolibarr < 24.0.0 Members REST API Improper Authorization via Password ResetPriority HIGH 72
    • TI-2026-50109 Dolibarr < 24.0.0 Payments REST API Improper Authorization via Delete EndpointPriority HIGH 65
    • TI-2026-50114 Dolibarr < 24.0.0 Members REST API Sensitive Data Exposure via Member EndpointsPriority MEDIUM 64
    Show all 10 records →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-71505
  2. 2026-10-03 Alias added: GHSA-c275-q2j8-wwg9

References

Exploit 1

Patch 1

Other 1

  • TI-2022-21049 Dolibarr Open Source ERP & CRM for Business before v14.0.1 allows attackers to escalate privileges via a crafted API. CVSS 3.1CRITICAL 9.8
  • TI-2022-03742 SQL Injection in dolibarr/dolibarr CVSS 3.1CRITICAL 9.8
  • TI-2023-14191 Dolibarr before 17.0.1 allows remote code execution by an authenticated user via an… CVSS 3.1HIGH 8.8
  • TI-2018-15582 Dolibarr ERP CRM 7.0.3 Remote Code Execution via install/step1.php CVSS 4.0CRITICAL 9.3
  • TI-2018-07157 SQL injection vulnerability in Dolibarr before 7.0.2 allows remote attackers to execute… CVSS 3.0CRITICAL 9.8
  • TI-2019-15505 Dolibarr ERP/CRM 10.0.1 SQL Injection via elemid CVSS 4.0HIGH 8.8
See all 168 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences