CVE-2026-71508: Dolibarr < 24.0.0 REST API Improper Authorization via User Update Endpoint
Dolibarr before 24.0.0 contains an improper authorization vulnerability in the user REST API update endpoint that allows attackers with user-write rights to modify payroll fields by exploiting an incomplete credential denylist that omits payroll columns. Attackers can rewrite salary, bonus, hourly rate, daily rate, and weekly hours for any user without holding payroll rights, with the modified values appearing in payroll export reports.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Dolibarrto a version that resolves this vulnerability.Fixed in 24.0.0
Event History
Frequently Asked Questions
Who can exploit this issue?
An authenticated attacker with user-write rights can exploit it. Payroll-specific rights are not required to alter the affected payroll fields.
Which data can be changed through the vulnerable endpoint?
An attacker can modify salary, bonus, hourly rate, daily rate, and weekly hours for any user. The altered values can then appear in payroll export reports.
Are installations running version 24.0.0 affected?
The issue affects Dolibarr versions before 24.0.0. Version 24.0.0 is not identified as affected.