CVE-2026-71504

Dolibarr before 24.0.0 contains an improper authorization vulnerability in the Members REST API that allows attackers with only member-creation rights to reset the password of any user account, including the system administrator, without verifying password-change permissions. Attackers can supply an arbitrary user account identifier and new password in the request body to overwrite credentials and immediately lock out the legitimate account holder.

CVSS v3 8.1 HIGH

8.1^/10

CVSS v3 : HIGH

Vector :

Exploitability : 2.8 / Impact : 5.2

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://codeant.ai/security-research/cve-2026-71504-mass-assignment-in-members-api-via-pass
https://github.com/Dolibarr/dolibarr/commit/fbf476cc5d9a21b16bfa04ab17d4e84eda38d7ce
https://github.com/Dolibarr/dolibarr/releases/tag/24.0.0
https://www.vulncheck.com/advisories/dolibarr-members-rest-api-improper-authorization-via-password-reset

Configurations

No configuration.

History

12 Oct 2026, 22:10

Type	Values Removed	Values Added
Summary		(es) Dolibarr antes de 24.0.0 contiene una vulnerabilidad de autorización impropia en la API REST de Miembros que permite a atacantes con solo derechos de creación de miembros restablecer la contraseña de cualquier cuenta de usuario, incluyendo la del administrador del sistema, sin verificar los permisos de cambio de contraseña. Los atacantes pueden proporcionar un identificador de cuenta de usuario arbitrario y una nueva contraseña en el cuerpo de la solicitud para sobrescribir las credenciales y bloquear inmediatamente al titular legítimo de la cuenta.

Information

Published : 2026-08-24 19:16

Updated : 2026-10-12 22:10

NVD link : CVE-2026-71504

Mitre link : CVE-2026-71504

CVE.ORG link : CVE-2026-71504

JSON object : View

Products Affected

No product.

CWE

CWE-862

Missing Authorization

CWE-915

Improperly Controlled Modification of Dynamically-Determined Object Attributes

{"id": "CVE-2026-71504", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-71504", "role": "CISA Coordinator", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "total"}], "version": "2.0.3", "timestamp": "2026-08-27T13:56:36.619257Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "disclosure@vulncheck.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.1, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 5.2, "exploitabilityScore": 2.8}], "cvssMetricV40": [{"type": "Secondary", "source": "disclosure@vulncheck.com", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 8.6, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "HIGH", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "LOW", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "disclosure@vulncheck.com", "affectedData": [{"repo": "https://github.com/Dolibarr/dolibarr", "vendor": "Dolibarr", "product": "dolibarr", "versions": [{"status": "affected", "version": "0", "lessThan": "24.0.0", "versionType": "semver"}], "packageURL": "pkg:github/Dolibarr/dolibarr", "defaultStatus": "affected"}]}], "published": "2026-08-24T19:16:49.670", "references": [{"url": "https://codeant.ai/security-research/cve-2026-71504-mass-assignment-in-members-api-via-pass", "source": "disclosure@vulncheck.com"}, {"url": "https://github.com/Dolibarr/dolibarr/commit/fbf476cc5d9a21b16bfa04ab17d4e84eda38d7ce", "source": "disclosure@vulncheck.com"}, {"url": "https://github.com/Dolibarr/dolibarr/releases/tag/24.0.0", "source": "disclosure@vulncheck.com"}, {"url": "https://www.vulncheck.com/advisories/dolibarr-members-rest-api-improper-authorization-via-password-reset", "source": "disclosure@vulncheck.com"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "disclosure@vulncheck.com", "description": [{"lang": "en", "value": "CWE-862"}, {"lang": "en", "value": "CWE-915"}]}], "descriptions": [{"lang": "en", "value": "Dolibarr before 24.0.0 contains an improper authorization vulnerability in the Members REST API that allows attackers with only member-creation rights to reset the password of any user account, including the system administrator, without verifying password-change permissions. Attackers can supply an arbitrary user account identifier and new password in the request body to overwrite credentials and immediately lock out the legitimate account holder."}, {"lang": "es", "value": "Dolibarr antes de 24.0.0 contiene una vulnerabilidad de autorizaci\u00f3n impropia en la API REST de Miembros que permite a atacantes con solo derechos de creaci\u00f3n de miembros restablecer la contrase\u00f1a de cualquier cuenta de usuario, incluyendo la del administrador del sistema, sin verificar los permisos de cambio de contrase\u00f1a. Los atacantes pueden proporcionar un identificador de cuenta de usuario arbitrario y una nueva contrase\u00f1a en el cuerpo de la solicitud para sobrescribir las credenciales y bloquear inmediatamente al titular leg\u00edtimo de la cuenta."}], "lastModified": "2026-10-12T22:10:00.247", "sourceIdentifier": "disclosure@vulncheck.com"}