CVE-2026-71510: Dolibarr < 24.0.0 Users REST API SQL Injection via filter parameter
Dolibarr before 24.0.0 contains a SQL injection vulnerability in the users REST API that allows authenticated attackers with user-read rights to extract sensitive data by splicing unsanitized filter parameters into SQL WHERE clauses without column restrictions. Attackers can perform binary search on numeric fields and LIKE prefix iteration on string fields to recover salary figures and password verifiers omitted from normal API responses, while raw database error messages in the same endpoint enable column name enumeration.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Dolibarr Users REST APIto a version that resolves this vulnerability.Fixed in 24.0.0 - Compensating control
Restrict access to the Dolibarr users REST API endpoint (with the vulnerable filter parameter) to the minimum set of authenticated users with user-read rights, to limit who can exploit the SQL injection.
Event History
Frequently Asked Questions
Who can exploit this vulnerability?
An attacker must be authenticated and have user-read rights in Dolibarr. The vulnerable REST API is network-accessible, and no user interaction is required.
What information could be exposed?
An attacker can extract sensitive database data, including salary figures and password verifiers that are omitted from normal API responses. Error messages from the endpoint can also be used to enumerate database column names.
Which versions are affected and what is the fix?
Dolibarr versions before 24.0.0 are affected. Upgrade to version 24.0.0 or later.
What can be done if an upgrade is not immediately possible?
Restrict access to the users REST API and remove user-read rights from accounts that do not require them. Limiting authenticated access reduces the set of users able to send malicious filter parameters.