CVE-2026-71509highCWE-862

CVE-2026-71509: fallo de gravedad alta en dolibarr

Dolibarr < 24.0.0 Expense Report REST API Improper Authorization via Update Endpoint

Publicada el · Actualizada el

Seguir esta CVE+ Monitorear dolibarr

Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.

41Vexday Risk Score

Sin señal de explotación. Ella tiene prueba de concepto pública.

ssvc Attendcvss 7.1epss 0.4%
Dolibarr before 24.0.0 contains an improper authorization vulnerability in the expense report REST API update endpoint that allows authenticated attackers with expense-creation rights to bypass the approval workflow by directly setting approval status and approver identity fields. Attackers can manipulate workflow state fields through the REST API to advance expense reports to approved or closed status without possessing the dedicated approval right, while also creating forensic inconsistencies in audit records due to missing approval timestamps.
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N
Productos afectados
Dolibarr · dolibarr
⚠ Recursos públicos, para evaluar la exposición de sistemas que controlas o estás autorizado a probar. Prueba solo con autorización.
CVEs relacionadas — dolibarr

En el mismo producto, de las más peligrosas a las menos.

CVE-2026-116219HIGHDolibarr ERP CRM before 24.0.0 OS Command Injection via mysqldump ParameterEPSS 2.1%CVE-2026-34036MEDIUMDolibarr Core Discloses Sensitive Data via Authenticated Local File Inclusion in selectobject.phpEPSS 1.5%CVE-2021-25957HIGHAccount Takeover in "Dolibarr" via Password Reset FunctionalityEPSS 1.1%CVE-2021-25956MEDIUMImproper User Access Control in "Dolibarr" Leads to Account TakeoverEPSS 0.9%CVE-2026-23500CRITICALDolibarr: OS Command Injection (RCE) via MAIN_ODT_AS_PDF configurationEPSS 0.9%CVE-2021-25955CRITICALStored XSS in “Dolibarr” leads to privilege escalationEPSS 0.9%