CVE-2026-71511: Dolibarr < 24.0.0 Members REST API Sensitive Data Exposure via Member Endpoints
Dolibarr before 24.0.0 contains a sensitive data exposure vulnerability in the Members REST API that allows authenticated attackers with member-read rights to retrieve bcrypt password verifiers by querying member endpoints. Attackers can call the individual member or member list endpoints to obtain crypted password verifier fields that are not filtered by the base API serializer or the Members API class, potentially enabling offline password cracking attacks.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Dolibarrto a version that resolves this vulnerability.Fixed in 24.0.0
Event History
Frequently Asked Questions
Who can exploit this issue?
An authenticated attacker with member-read rights can exploit it. The attack can be performed remotely through the Members REST API without user interaction.
Which API requests expose the password verifiers?
Both individual member endpoints and member list endpoints can return crypted bcrypt password verifier fields in affected versions.
What is the likely impact if the exposed data is obtained?
The exposed bcrypt password verifiers may be used for offline password-cracking attempts. The reported impact is confidentiality loss; integrity and availability are not identified as affected.
How can I determine whether my deployment is affected?
Dolibarr versions before 24.0.0 are affected. In an affected deployment, test the Members REST API using an account with member-read rights and check whether member responses include crypted password verifier fields.