Read the docs
TI-2026-50113 Aliases CVE-2026-71510GHSA-5qq2-5wmp-fh5h

Dolibarr < 24.0.0 Users REST API SQL Injection via filter parameter

Priority MEDIUM 64CWE-863Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
Security bypass
Confidentiality · integrity · availability
High · None · None
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-863.

Summary

Dolibarr before 24.0.0 contains a SQL injection vulnerability in the users REST API that allows authenticated attackers with user-read rights to extract sensitive data by splicing unsanitized filter parameters into SQL WHERE clauses without column restrictions. Attackers can perform binary search on numeric fields and LIKE prefix iteration on string fields to recover salary figures and password verifiers omitted from normal API responses, while raw database error messages in the same endpoint enable column name enumeration.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00382 32nd percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by the CNA
Fix Fixed dolibarr (Dolibarr): 24.0.0

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
Dolibarrdolibarrbefore 24.0.024.0.0Patch availableCNA
  • dolibarr VendorDolibarr Affected before 24.0.0 Fixed in 24.0.0 Patch available CNA

Remediation

  • Fix · CNA dolibarr (Dolibarr) Fixed in 24.0.0

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Release ·

    dolibarr 24.0.0

    10 records Highest priority Priority HIGH 2 HIGH, 7 MEDIUM, 1 LOW

    Other records, highest priority first

    • TI-2026-50107 Dolibarr < 24.0.0 Members REST API Improper Authorization via Password ResetPriority HIGH 72
    • TI-2026-50109 Dolibarr < 24.0.0 Payments REST API Improper Authorization via Delete EndpointPriority HIGH 65
    • TI-2026-50114 Dolibarr < 24.0.0 Members REST API Sensitive Data Exposure via Member EndpointsPriority MEDIUM 64
    Show all 10 records →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-71510
  2. 2026-10-03 Alias added: GHSA-5qq2-5wmp-fh5h

References

Exploit 1

Patch 1

Other 1

  • TI-2022-21049 Dolibarr Open Source ERP & CRM for Business before v14.0.1 allows attackers to escalate privileges via a crafted API. CVSS 3.1CRITICAL 9.8
  • TI-2022-03742 SQL Injection in dolibarr/dolibarr CVSS 3.1CRITICAL 9.8
  • TI-2023-14191 Dolibarr before 17.0.1 allows remote code execution by an authenticated user via an… CVSS 3.1HIGH 8.8
  • TI-2018-15582 Dolibarr ERP CRM 7.0.3 Remote Code Execution via install/step1.php CVSS 4.0CRITICAL 9.3
  • TI-2018-07157 SQL injection vulnerability in Dolibarr before 7.0.2 allows remote attackers to execute… CVSS 3.0CRITICAL 9.8
  • TI-2019-15505 Dolibarr ERP/CRM 10.0.1 SQL Injection via elemid CVSS 4.0HIGH 8.8
See all 168 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences