CVE-2026-71503: Dolibarr < 24.0.0 Reflected XSS via Extra Fields Administration Template
Dolibarr before 24.0.0 contains a reflected cross-site scripting vulnerability in the extra fields administration template where the type request parameter is echoed without JavaScript-context encoding into an inline script block and no Content-Security-Policy header is emitted. An unauthenticated attacker can cause an authenticated administrator to open a crafted URL to execute arbitrary JavaScript in that session and create a persistent administrator account.
Affected Software
Event History
Frequently Asked Questions
Who is exposed to exploitation?
Dolibarr installations before 24.0.0 are affected when an authenticated administrator can be persuaded to open an attacker-crafted URL. The attacker does not need an account, but exploitation requires administrator interaction.
What could an attacker achieve after successful exploitation?
The attacker can execute arbitrary JavaScript in the administrator's authenticated session. The description states this can be used to create a persistent administrator account.
Is this mitigated by a Content-Security-Policy header?
The affected template does not emit a Content-Security-Policy header. The vulnerable type request parameter is also inserted into an inline script block without JavaScript-context encoding.
How can I determine whether my instance is affected?
Check the Dolibarr version in use. Versions before 24.0.0 are affected; the provided release information identifies 24.0.0 as the fixed version.