CVE-2026-71508

Dolibarr before 24.0.0 contains an improper authorization vulnerability in the user REST API update endpoint that allows attackers with user-write rights to modify payroll fields by exploiting an incomplete credential denylist that omits payroll columns. Attackers can rewrite salary, bonus, hourly rate, daily rate, and weekly hours for any user without holding payroll rights, with the modified values appearing in payroll export reports.

CVSS v3 6.5 MEDIUM

6.5^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 2.8 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact HIGH

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://codeant.ai/security-research/cve-2026-71508-dolibarr-payroll-mass-assignment
https://github.com/Dolibarr/dolibarr/commit/c85d0e840725a3c1a2f49b3e97766469c3cb02b6
https://github.com/Dolibarr/dolibarr/releases/tag/24.0.0
https://www.vulncheck.com/advisories/dolibarr-rest-api-improper-authorization-via-user-update-endpoint

Configurations

No configuration.

History

12 Oct 2026, 22:10

Type	Values Removed	Values Added
Summary		(es) Dolibarr anterior a la versión 24.0.0 contiene una vulnerabilidad de autorización inadecuada en el endpoint de actualización de la API REST de usuario que permite a atacantes con derechos de escritura de usuario modificar campos de nómina explotando una lista de denegación de credenciales incompleta que omite columnas de nómina. Los atacantes pueden reescribir el salario, la bonificación, la tarifa por hora, la tarifa diaria y las horas semanales para cualquier usuario sin poseer derechos de nómina, con los valores modificados apareciendo en los informes de exportación de nómina.

Information

Published : 2026-08-24 19:16

Updated : 2026-10-12 22:10

NVD link : CVE-2026-71508

Mitre link : CVE-2026-71508

CVE.ORG link : CVE-2026-71508

JSON object : View

Products Affected

No product.

CWE

CWE-862

Missing Authorization

{"id": "CVE-2026-71508", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-71508", "role": "CISA Coordinator", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-08-24T19:19:26.828292Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "disclosure@vulncheck.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.5, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 2.8}], "cvssMetricV40": [{"type": "Secondary", "source": "disclosure@vulncheck.com", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 7.1, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "HIGH", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "LOW", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "NONE", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "disclosure@vulncheck.com", "affectedData": [{"repo": "https://github.com/Dolibarr/dolibarr", "vendor": "Dolibarr", "product": "dolibarr", "versions": [{"status": "affected", "version": "0", "lessThan": "24.0.0", "versionType": "semver"}], "packageURL": "pkg:github/Dolibarr/dolibarr", "defaultStatus": "affected"}]}], "published": "2026-08-24T19:16:50.253", "references": [{"url": "https://codeant.ai/security-research/cve-2026-71508-dolibarr-payroll-mass-assignment", "source": "disclosure@vulncheck.com"}, {"url": "https://github.com/Dolibarr/dolibarr/commit/c85d0e840725a3c1a2f49b3e97766469c3cb02b6", "source": "disclosure@vulncheck.com"}, {"url": "https://github.com/Dolibarr/dolibarr/releases/tag/24.0.0", "source": "disclosure@vulncheck.com"}, {"url": "https://www.vulncheck.com/advisories/dolibarr-rest-api-improper-authorization-via-user-update-endpoint", "source": "disclosure@vulncheck.com"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "disclosure@vulncheck.com", "description": [{"lang": "en", "value": "CWE-862"}]}], "descriptions": [{"lang": "en", "value": "Dolibarr before 24.0.0 contains an improper authorization vulnerability in the user REST API update endpoint that allows attackers with user-write rights to modify payroll fields by exploiting an incomplete credential denylist that omits payroll columns. Attackers can rewrite salary, bonus, hourly rate, daily rate, and weekly hours for any user without holding payroll rights, with the modified values appearing in payroll export reports."}, {"lang": "es", "value": "Dolibarr anterior a la versi\u00f3n 24.0.0 contiene una vulnerabilidad de autorizaci\u00f3n inadecuada en el endpoint de actualizaci\u00f3n de la API REST de usuario que permite a atacantes con derechos de escritura de usuario modificar campos de n\u00f3mina explotando una lista de denegaci\u00f3n de credenciales incompleta que omite columnas de n\u00f3mina. Los atacantes pueden reescribir el salario, la bonificaci\u00f3n, la tarifa por hora, la tarifa diaria y las horas semanales para cualquier usuario sin poseer derechos de n\u00f3mina, con los valores modificados apareciendo en los informes de exportaci\u00f3n de n\u00f3mina."}], "lastModified": "2026-10-12T22:10:00.247", "sourceIdentifier": "disclosure@vulncheck.com"}