CVE-2026-71511

Dolibarr before 24.0.0 contains a sensitive data exposure vulnerability in the Members REST API that allows authenticated attackers with member-read rights to retrieve bcrypt password verifiers by querying member endpoints. Attackers can call the individual member or member list endpoints to obtain crypted password verifier fields that are not filtered by the base API serializer or the Members API class, potentially enabling offline password cracking attacks.

CVSS v3 6.5 MEDIUM

6.5^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 2.8 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://codeant.ai/security-research/cve-2026-71511-dolibarr-members-api-exposes-password-hashes
https://github.com/Dolibarr/dolibarr/commit/b1691356eb96d962833e5c7325c9e58e6823c78d
https://github.com/Dolibarr/dolibarr/releases/tag/24.0.0
https://www.vulncheck.com/advisories/dolibarr-members-rest-api-sensitive-data-exposure-via-member-endpoints

Configurations

No configuration.

History

12 Oct 2026, 21:10

Type	Values Removed	Values Added
Summary		(es) Dolibarr anterior a la versión 24.0.0 contiene una vulnerabilidad de exposición de datos sensibles en la API REST de Miembros que permite a atacantes autenticados con derechos de lectura de miembros recuperar verificadores de contraseña bcrypt consultando los puntos finales de miembros. Los atacantes pueden llamar a los puntos finales de miembros individuales o de lista de miembros para obtener campos de verificador de contraseña cifrados que no son filtrados por el serializador base de la API o la clase de la API de Miembros, lo que podría permitir ataques de descifrado de contraseñas sin conexión.

Information

Published : 2026-08-24 20:17

Updated : 2026-10-12 21:10

NVD link : CVE-2026-71511

Mitre link : CVE-2026-71511

CVE.ORG link : CVE-2026-71511

JSON object : View

Products Affected

No product.

CWE

CWE-522

Insufficiently Protected Credentials

{"id": "CVE-2026-71511", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-71511", "role": "CISA Coordinator", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-08-26T15:46:30.892584Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "disclosure@vulncheck.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.5, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 3.6, "exploitabilityScore": 2.8}], "cvssMetricV40": [{"type": "Secondary", "source": "disclosure@vulncheck.com", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 7.1, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "HIGH", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "LOW", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "NONE", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "disclosure@vulncheck.com", "affectedData": [{"repo": "https://github.com/Dolibarr/dolibarr", "vendor": "Dolibarr", "product": "dolibarr", "versions": [{"status": "affected", "version": "0", "lessThan": "24.0.0", "versionType": "semver"}], "packageURL": "pkg:github/Dolibarr/dolibarr", "defaultStatus": "affected"}]}], "published": "2026-08-24T20:17:13.420", "references": [{"url": "https://codeant.ai/security-research/cve-2026-71511-dolibarr-members-api-exposes-password-hashes", "source": "disclosure@vulncheck.com"}, {"url": "https://github.com/Dolibarr/dolibarr/commit/b1691356eb96d962833e5c7325c9e58e6823c78d", "source": "disclosure@vulncheck.com"}, {"url": "https://github.com/Dolibarr/dolibarr/releases/tag/24.0.0", "source": "disclosure@vulncheck.com"}, {"url": "https://www.vulncheck.com/advisories/dolibarr-members-rest-api-sensitive-data-exposure-via-member-endpoints", "source": "disclosure@vulncheck.com"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "disclosure@vulncheck.com", "description": [{"lang": "en", "value": "CWE-522"}]}], "descriptions": [{"lang": "en", "value": "Dolibarr before 24.0.0 contains a sensitive data exposure vulnerability in the Members REST API that allows authenticated attackers with member-read rights to retrieve bcrypt password verifiers by querying member endpoints. Attackers can call the individual member or member list endpoints to obtain crypted password verifier fields that are not filtered by the base API serializer or the Members API class, potentially enabling offline password cracking attacks."}, {"lang": "es", "value": "Dolibarr anterior a la versi\u00f3n 24.0.0 contiene una vulnerabilidad de exposici\u00f3n de datos sensibles en la API REST de Miembros que permite a atacantes autenticados con derechos de lectura de miembros recuperar verificadores de contrase\u00f1a bcrypt consultando los puntos finales de miembros. Los atacantes pueden llamar a los puntos finales de miembros individuales o de lista de miembros para obtener campos de verificador de contrase\u00f1a cifrados que no son filtrados por el serializador base de la API o la clase de la API de Miembros, lo que podr\u00eda permitir ataques de descifrado de contrase\u00f1as sin conexi\u00f3n."}], "lastModified": "2026-10-12T21:10:00.227", "sourceIdentifier": "disclosure@vulncheck.com"}