Dolibarr < 24.0.0 REST API Improper Authorization via User Update Endpoint
41Vexday Risk Score
Sin señal de explotación. Ella tiene prueba de concepto pública.
ssvc Attendcvss 7.1epss 0.2%
probabilidad de explotación
0.2%top 88% de las CVE
explotación observada
noninguna fuente lo reporta
1 exploit(s) público(s)
Dolibarr before 24.0.0 contains an improper authorization vulnerability in the user REST API update endpoint that allows attackers with user-write rights to modify payroll fields by exploiting an incomplete credential denylist that omits payroll columns. Attackers can rewrite salary, bonus, hourly rate, daily rate, and weekly hours for any user without holding payroll rights, with the modified values appearing in payroll export reports.
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N
Productos afectados
Dolibarr · dolibarrPoCs públicas encontradas — 1
cve_referencecodeant.ai/security-research/cve-2026-71508-dolibarr-payroll-mass-assignmentno verificado⚠ Recursos públicos, para evaluar la exposición de sistemas que controlas o estás autorizado a probar. Prueba solo con autorización.
Referencias
https://codeant.ai/security-research/cve-2026-71508-dolibarr-payroll-mass-assignmenthttps://github.com/Dolibarr/dolibarr/commit/c85d0e840725a3c1a2f49b3e97766469c3cb02b6https://github.com/Dolibarr/dolibarr/releases/tag/24.0.0https://www.vulncheck.com/advisories/dolibarr-rest-api-improper-authorization-via-user-update-endpoint