CVE-2026-71508 - Dolibarr < 24.0.0 REST API Improper Authorization via User Update Endpoint

Back Back to CVE browser

HIGH

Dolibarr < 24.0.0 REST API Improper Authorization via User Update Endpoint

Published Aug 24, 2026

7.1

HIGH

CVSS 4.0

EPSS 0.39%

Description

Dolibarr before 24.0.0 contains an improper authorization vulnerability in the user REST API update endpoint that allows attackers with user-write rights to modify payroll fields by exploiting an incomplete credential denylist that omits payroll columns. Attackers can rewrite salary, bonus, hourly rate, daily rate, and weekly hours for any user without holding payroll rights, with the modified values appearing in payroll export reports.

Affected products

Vendor Dolibarr Product Dolibarr Default
affected
- Version
  0
  Status
  affected
  Constraints
  <24.0.0

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

Dolibarr

affected

Version	Status	Constraints
0	affected	<24.0.0

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-862

Missing Authorization

References (5)

https://codeant.ai/security-research/cve-2026-71508-dolibarr-payroll-mass-assignment
technical-descriptionexploit
https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-65081
Advisory
https://github.com/Dolibarr/dolibarr/commit/c85d0e840725a3c1a2f49b3e97766469c3cb02b6
patch
https://github.com/Dolibarr/dolibarr/releases/tag/24.0.0
release-notes
https://www.vulncheck.com/advisories/dolibarr-rest-api-improper-authorization-via-user-update-endpoint
third-party-advisory

Link	Providers	Tags
https://codeant.ai/security-research/cve-2026-71508-dolibarr-payroll-mass-assignment		technical-descriptionexploit
https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-65081		Advisory
https://github.com/Dolibarr/dolibarr/commit/c85d0e840725a3c1a2f49b3e97766469c3cb02b6		patch
https://github.com/Dolibarr/dolibarr/releases/tag/24.0.0		release-notes
https://www.vulncheck.com/advisories/dolibarr-rest-api-improper-authorization-via-user-update-endpoint		third-party-advisory