CVE-2026-71507
MediumCVSS 6.5Exploitation Probability (EPSS)
Low risk12th percentile - higher than 12% of all known CVEs
Summary
Dolibarr before 24.0.0 contains a broken object-level authorization vulnerability in the REST API company bank account write routes. Authenticated attackers with third-party creation rights can create, replace, or delete bank account details of any company without requiring read access to that company. Attackers can inject attacker-controlled IBANs as creditor accounts, which are then written into regenerated SEPA credit-transfer files, redirecting outgoing payments to attacker-controlled accounts.
Risk Assessment
The risk includes the possibility of redirecting payments to attacker-controlled accounts, potentially leading to significant financial losses.
Recommendation
Upgrade Dolibarr to version 24.0.0 or later. Also enforce object-level access control for bank account routes.
Other vulnerabilities in Dolibarr
See all- CVE-2023-33568High
An issue in Dolibarr 16 before 16.0.5 allows unauthenticated attackers to perform a database dump and access a company's entire customer file, prospects, suppliers, and employee information if a contact file exists.
- CVE-2017-14242Critical
CVE-2017-14242 is an SQL injection vulnerability in don/list.php in Dolibarr version 6.0.0 that allows remote attackers to execute arbitrary SQL commands via the statut parameter.
- CVE-2026-81730High
Dolibarr versions 9.0.0 through 23.0.4 save inbound email attachments under the name supplied in MIME headers without reducing it to a safe basename. The saveAttachment() functions in htdocs/emailcollector/lib/emailcollector.lib.php and htdocs/emailcollector/class/emailcollector.class.php build the file path from the attachment name, which may contain path traversal sequences, allowing writes outside the target directory.
- CVE-2026-81729Medium
Dolibarr before 23.0.4 authorizes REST API document deletion against the wrong permission. Documents::delete() calls dol_check_secure_access_document() with mode 'read' instead of 'write', allowing an authenticated user with only read permissions to permanently delete module documents.
- CVE-2026-81728High
Dolibarr before 24.0.0 contains a SQL injection vulnerability in its CSV and XLSX import wizard. The wizard reads update keys via GETPOST('updatekeys', 'array') in htdocs/imports/import.php, applying only the generic alphanohtml filter that leaves SQL keywords, comment markers, parentheses, spaces, and quotes intact. The import_insert() function in htdocs/core/modules/import/import_csv.modules.php builds a filter with $where[] = $key.' = '.$data[$key] and executes it via $this->db->query(), allowing SQL injection.
- CVE-2026-77923Medium
Dolibarr 21.0.0 before 24.0.0 contains an authorization bypass vulnerability caused by an inverted boolean condition in the private-project membership check within the clonetasks mass action handler in htdocs/core/actions_massactions.inc.php. Authenticated users with project creation permission but without access to a target private project can exploit the flawed !in_array() check to clone tasks into unauthorized private projects.
- CVE-2026-71511Medium
Dolibarr before 24.0.0 contains a sensitive data exposure vulnerability in the Members REST API. Authenticated attackers with member-read rights can retrieve bcrypt password verifiers by querying member endpoints. The verifier fields are not filtered by the base API serializer or the Members API class, enabling offline password cracking.
- CVE-2026-71510Medium
Dolibarr before 24.0.0 contains a SQL injection vulnerability in the users REST API. Authenticated attackers with user-read rights can extract sensitive data by splicing unsanitized filter parameters into SQL WHERE clauses without column restrictions. Attackers can perform binary search on numeric fields and LIKE prefix iteration on string fields to recover salary figures and password verifiers, while raw database errors enable column name enumeration.
- CVE-2026-71509Medium
Dolibarr before 24.0.0 contains an improper authorization vulnerability in the expense report REST API update endpoint. Authenticated attackers with expense-creation rights can bypass the approval workflow by directly setting approval status and approver identity fields. Attackers can manipulate workflow state fields to advance expense reports to approved or closed status without possessing the dedicated approval right, while also creating forensic inconsistencies in audit records due to missing approval timestamps.
- CVE-2026-71508Medium
Dolibarr before 24.0.0 contains an improper authorization vulnerability in the user REST API update endpoint. Attackers with user-write rights can modify payroll fields by exploiting an incomplete credential denylist that omits payroll columns. Attackers can rewrite salary, bonus, hourly rate, daily rate, and weekly hours for any user without holding payroll rights, with the modified values appearing in payroll export reports.
Original NVD description (English source)
Dolibarr before 24.0.0 contains a broken object-level authorization vulnerability in the REST API company bank account write routes that allows authenticated attackers with third-party creation rights to create, replace, or delete bank account details of any company without requiring read access to that company. Attackers can inject attacker-controlled IBANs as creditor accounts, which are then written into regenerated SEPA credit-transfer files, redirecting outgoing payments to attacker-controlled accounts.