Dolibarr ERP CVE-2026-71503

The victim must be an authenticated Dolibarr administrator with an active browser session at the time they open the crafted URL - a low-privilege authenticated user cannot trigger the account-creation payload because admin-only API endpoints require administrator privileges. The attacker requires no credentials or prior access to the Dolibarr instance. The vulnerable endpoint is the extra fields administration template, which is a standard feature enabled by default in all Dolibarr installations; no special configuration is required. Exploitation is limited by the mandatory active user interaction (UI:A in CVSS 4.0): the administrator must be socially engineered into opening the attacker-controlled URL in a session-bearing browser tab. The absence of a Content-Security-Policy header is a necessary condition - if a deployment-level CSP is enforced by a reverse proxy, exploitation may be blocked depending on the directive configuration.

The CVSS 4.0 base score of 5.1 reflects the mandatory user-interaction requirement (UI:A), which meaningfully limits opportunistic exploitation. However, the downstream consequence - creation of a persistent administrator account - represents a disproportionately severe business impact compared to the score alone. The publicly available exploit code (confirmed by VulnCheck and codeant.ai security research) lowers the bar for exploitation significantly. No EPSS data was provided in the input, and this CVE is not listed in CISA KEV, so mass exploitation is not confirmed; however, the admin-account-creation payload makes targeted spear-phishing against Dolibarr administrators a credible threat. The CVSS 4.0 subsequent-system integrity metric SI:L may understate real impact given account persistence. Real-world risk is elevated for organizations where Dolibarr administrators routinely receive external links, cannot be trained to validate URLs, or where MFA is absent - the stolen session or created backdoor account would otherwise be the sole access control.

An attacker crafts a URL targeting Dolibarr's extra fields administration endpoint with a type parameter containing a JavaScript payload - for example, one that issues an authenticated API call to create a new admin user. The attacker delivers this URL to a Dolibarr administrator via a phishing email or message. When the administrator clicks the link in their authenticated browser session, the unescaped type value executes within the inline script block, silently creating a backdoor admin account the attacker controls. A publicly available proof-of-concept demonstrating this technique exists at https://codeant.ai/security-research/cve-2026-71503-reflected-xss-via-the-type-parameter.