CVE-2026-71509

Dolibarr before 24.0.0 contains an improper authorization vulnerability in the expense report REST API update endpoint that allows authenticated attackers with expense-creation rights to bypass the approval workflow by directly setting approval status and approver identity fields. Attackers can manipulate workflow state fields through the REST API to advance expense reports to approved or closed status without possessing the dedicated approval right, while also creating forensic inconsistencies in audit records due to missing approval timestamps.

CVSS v3 6.5 MEDIUM

6.5^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 2.8 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact HIGH

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://codeant.ai/security-research/cve-2026-71509-dolibarr-mass-assignment-lets-users-self-approve-expenses
https://github.com/Dolibarr/dolibarr/commit/9c4eb945321f823955879600e9dc58a44d249e44
https://github.com/Dolibarr/dolibarr/releases/tag/24.0.0
https://www.vulncheck.com/advisories/dolibarr-expense-report-rest-api-improper-authorization-via-update-endpoint

Configurations

No configuration.

History

12 Oct 2026, 22:10

Type	Values Removed	Values Added
Summary		(es) Dolibarr anterior a la versión 24.0.0 contiene una vulnerabilidad de autorización impropia en el endpoint de actualización de la API REST del informe de gastos que permite a atacantes autenticados con derechos de creación de gastos eludir el flujo de trabajo de aprobación al establecer directamente el estado de aprobación y los campos de identidad del aprobador. Los atacantes pueden manipular los campos de estado del flujo de trabajo a través de la API REST para avanzar los informes de gastos a estado aprobado o cerrado sin poseer el derecho de aprobación dedicado, mientras que también crean inconsistencias forenses en los registros de auditoría debido a la falta de marcas de tiempo de aprobación.

Information

Published : 2026-08-24 19:16

Updated : 2026-10-12 22:10

NVD link : CVE-2026-71509

Mitre link : CVE-2026-71509

CVE.ORG link : CVE-2026-71509

JSON object : View

Products Affected

No product.

CWE

CWE-862

Missing Authorization

{"id": "CVE-2026-71509", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-71509", "role": "CISA Coordinator", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-08-27T14:11:29.853524Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "disclosure@vulncheck.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.5, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 2.8}], "cvssMetricV40": [{"type": "Secondary", "source": "disclosure@vulncheck.com", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 7.1, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "HIGH", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "LOW", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "NONE", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "disclosure@vulncheck.com", "affectedData": [{"repo": "https://github.com/Dolibarr/dolibarr", "vendor": "Dolibarr", "product": "dolibarr", "versions": [{"status": "affected", "version": "0", "lessThan": "24.0.0", "versionType": "semver"}], "packageURL": "pkg:github/Dolibarr/dolibarr", "defaultStatus": "affected"}]}], "published": "2026-08-24T19:16:50.403", "references": [{"url": "https://codeant.ai/security-research/cve-2026-71509-dolibarr-mass-assignment-lets-users-self-approve-expenses", "source": "disclosure@vulncheck.com"}, {"url": "https://github.com/Dolibarr/dolibarr/commit/9c4eb945321f823955879600e9dc58a44d249e44", "source": "disclosure@vulncheck.com"}, {"url": "https://github.com/Dolibarr/dolibarr/releases/tag/24.0.0", "source": "disclosure@vulncheck.com"}, {"url": "https://www.vulncheck.com/advisories/dolibarr-expense-report-rest-api-improper-authorization-via-update-endpoint", "source": "disclosure@vulncheck.com"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "disclosure@vulncheck.com", "description": [{"lang": "en", "value": "CWE-862"}]}], "descriptions": [{"lang": "en", "value": "Dolibarr before 24.0.0 contains an improper authorization vulnerability in the expense report REST API update endpoint that allows authenticated attackers with expense-creation rights to bypass the approval workflow by directly setting approval status and approver identity fields. Attackers can manipulate workflow state fields through the REST API to advance expense reports to approved or closed status without possessing the dedicated approval right, while also creating forensic inconsistencies in audit records due to missing approval timestamps."}, {"lang": "es", "value": "Dolibarr anterior a la versi\u00f3n 24.0.0 contiene una vulnerabilidad de autorizaci\u00f3n impropia en el endpoint de actualizaci\u00f3n de la API REST del informe de gastos que permite a atacantes autenticados con derechos de creaci\u00f3n de gastos eludir el flujo de trabajo de aprobaci\u00f3n al establecer directamente el estado de aprobaci\u00f3n y los campos de identidad del aprobador. Los atacantes pueden manipular los campos de estado del flujo de trabajo a trav\u00e9s de la API REST para avanzar los informes de gastos a estado aprobado o cerrado sin poseer el derecho de aprobaci\u00f3n dedicado, mientras que tambi\u00e9n crean inconsistencias forenses en los registros de auditor\u00eda debido a la falta de marcas de tiempo de aprobaci\u00f3n."}], "lastModified": "2026-10-12T22:10:00.247", "sourceIdentifier": "disclosure@vulncheck.com"}