CVE-2026-71510

Dolibarr before 24.0.0 contains a SQL injection vulnerability in the users REST API that allows authenticated attackers with user-read rights to extract sensitive data by splicing unsanitized filter parameters into SQL WHERE clauses without column restrictions. Attackers can perform binary search on numeric fields and LIKE prefix iteration on string fields to recover salary figures and password verifiers omitted from normal API responses, while raw database error messages in the same endpoint enable column name enumeration.

CVSS v3 6.5 MEDIUM

6.5^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 2.8 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://codeant.ai/security-research/cve-2026-71510-blind-column-extraction-via-sqlfilters
https://github.com/Dolibarr/dolibarr/commit/12687f83705c2a1e46aaf6f8d1ac7347bee4710c
https://github.com/Dolibarr/dolibarr/releases/tag/24.0.0
https://www.vulncheck.com/advisories/dolibarr-users-rest-api-sql-injection-via-filter-parameter

Configurations

No configuration.

History

12 Oct 2026, 21:10

Type	Values Removed	Values Added
Summary		(es) Dolibarr antes de 24.0.0 contiene una vulnerabilidad de inyección SQL en la API REST de usuarios que permite a atacantes autenticados con derechos de lectura de usuario extraer datos sensibles al empalmar parámetros de filtro no saneados en cláusulas SQL WHERE sin restricciones de columna. Los atacantes pueden realizar búsquedas binarias en campos numéricos e iteración de prefijo LIKE en campos de cadena para recuperar cifras salariales y verificadores de contraseña omitidos de las respuestas normales de la API, mientras que los mensajes de error brutos de la base de datos en el mismo endpoint permiten la enumeración de nombres de columna.

Information

Published : 2026-08-24 20:17

Updated : 2026-10-12 21:10

NVD link : CVE-2026-71510

Mitre link : CVE-2026-71510

CVE.ORG link : CVE-2026-71510

JSON object : View

Products Affected

No product.

CWE

CWE-863

Incorrect Authorization

{"id": "CVE-2026-71510", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-71510", "role": "CISA Coordinator", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-08-24T19:27:09.461430Z"}}], "cvssMetricV31": [{"type": "Primary", "source": "disclosure@vulncheck.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.5, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 3.6, "exploitabilityScore": 2.8}], "cvssMetricV40": [{"type": "Secondary", "source": "disclosure@vulncheck.com", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 7.1, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "HIGH", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "LOW", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "NONE", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "disclosure@vulncheck.com", "affectedData": [{"repo": "https://github.com/Dolibarr/dolibarr", "vendor": "Dolibarr", "product": "dolibarr", "versions": [{"status": "affected", "version": "0", "lessThan": "24.0.0", "versionType": "semver"}], "packageURL": "pkg:github/Dolibarr/dolibarr", "defaultStatus": "affected"}]}], "published": "2026-08-24T20:17:12.957", "references": [{"url": "https://codeant.ai/security-research/cve-2026-71510-blind-column-extraction-via-sqlfilters", "source": "disclosure@vulncheck.com"}, {"url": "https://github.com/Dolibarr/dolibarr/commit/12687f83705c2a1e46aaf6f8d1ac7347bee4710c", "source": "disclosure@vulncheck.com"}, {"url": "https://github.com/Dolibarr/dolibarr/releases/tag/24.0.0", "source": "disclosure@vulncheck.com"}, {"url": "https://www.vulncheck.com/advisories/dolibarr-users-rest-api-sql-injection-via-filter-parameter", "source": "disclosure@vulncheck.com"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Primary", "source": "disclosure@vulncheck.com", "description": [{"lang": "en", "value": "CWE-863"}]}], "descriptions": [{"lang": "en", "value": "Dolibarr before 24.0.0 contains a SQL injection vulnerability in the users REST API that allows authenticated attackers with user-read rights to extract sensitive data by splicing unsanitized filter parameters into SQL WHERE clauses without column restrictions. Attackers can perform binary search on numeric fields and LIKE prefix iteration on string fields to recover salary figures and password verifiers omitted from normal API responses, while raw database error messages in the same endpoint enable column name enumeration."}, {"lang": "es", "value": "Dolibarr antes de 24.0.0 contiene una vulnerabilidad de inyecci\u00f3n SQL en la API REST de usuarios que permite a atacantes autenticados con derechos de lectura de usuario extraer datos sensibles al empalmar par\u00e1metros de filtro no saneados en cl\u00e1usulas SQL WHERE sin restricciones de columna. Los atacantes pueden realizar b\u00fasquedas binarias en campos num\u00e9ricos e iteraci\u00f3n de prefijo LIKE en campos de cadena para recuperar cifras salariales y verificadores de contrase\u00f1a omitidos de las respuestas normales de la API, mientras que los mensajes de error brutos de la base de datos en el mismo endpoint permiten la enumeraci\u00f3n de nombres de columna."}], "lastModified": "2026-10-12T21:10:00.227", "sourceIdentifier": "disclosure@vulncheck.com"}