CVE-2026-71509: Dolibarr < 24.0.0 Expense Report REST API Improper Authorization via Update Endpoint
Dolibarr before 24.0.0 contains an improper authorization vulnerability in the expense report REST API update endpoint that allows authenticated attackers with expense-creation rights to bypass the approval workflow by directly setting approval status and approver identity fields. Attackers can manipulate workflow state fields through the REST API to advance expense reports to approved or closed status without possessing the dedicated approval right, while also creating forensic inconsistencies in audit records due to missing approval timestamps.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Dolibarrto a version that resolves this vulnerability.Fixed in 24.0.0 - Compensating control
Restrict access to the Dolibarr expense report REST API update endpoint so that only users who have the dedicated approval right can modify approval status and approver identity fields.
Event History
Frequently Asked Questions
Which users can exploit this issue?
Authenticated users who have permission to create expense reports can exploit the affected REST API update endpoint. They do not need the dedicated expense-approval right.
What access and interaction are required for exploitation?
The attacker needs network access to the REST API and a low-privilege authenticated account with expense-creation rights. No user interaction is required.
What can an attacker change through the vulnerable endpoint?
An attacker can directly set expense-report approval status and approver identity fields, advancing reports to approved or closed states while bypassing the normal approval workflow.
How can organizations identify potentially affected records?
Review expense reports for approval or closed workflow states where the approval identity or workflow history is inconsistent. Missing approval timestamps are a specific forensic indicator described for manipulated records.
What version addresses the issue?
Dolibarr 24.0.0 addresses this vulnerability. Versions before 24.0.0 are affected according to the provided information.