CVE-2026-71504: Dolibarr < 24.0.0 Members REST API Improper Authorization via Password Reset
Dolibarr before 24.0.0 contains an improper authorization vulnerability in the Members REST API that allows attackers with only member-creation rights to reset the password of any user account, including the system administrator, without verifying password-change permissions. Attackers can supply an arbitrary user account identifier and new password in the request body to overwrite credentials and immediately lock out the legitimate account holder.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
An authenticated attacker with member-creation rights can exploit it. They do not need password-change permissions for the account whose password they reset.
Which accounts can be taken over?
The attacker can supply an arbitrary user account identifier and overwrite that account's password. This includes the system administrator account.
What is required to perform the attack?
The attacker needs access to the Members REST API and member-creation rights. They can submit a request body containing a target account identifier and a new password, with no user interaction required.
What should affected deployments do?
Upgrade Dolibarr to version 24.0.0 or later. Until patching is possible, restrict member-creation rights and access to the Members REST API to only fully trusted users.
How can an organization tell whether an account may have been affected?
Investigate unexpected password changes, especially for privileged accounts, and reports that legitimate users have been locked out. The vulnerability allows credentials to be overwritten immediately.