Dolibarr ERP CVE-2026-71504

The attacker must possess a valid, authenticated Dolibarr account with member-creation rights, confirmed by the CVSS PR:L metric. No special deployment configuration, non-default feature flag, or specific Dolibarr module beyond the Members REST API being network-reachable (AV:N) is required. Exploitation requires no interaction from the target account holder (UI:N). The sole limiting factor is the requirement for at least one low-privilege authenticated account - unauthenticated external attackers cannot directly exploit this flaw. In practice, member-creation rights are commonly delegated to non-administrative users in typical Dolibarr deployments, making this barrier realistically low in many organizations.

The CVSS 4.0 base score of 8.6 (AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N) reflects a network-exploitable flaw requiring only a low-privilege authenticated account, no user interaction, and no special attack conditions, with high confidentiality and integrity impact to the vulnerable system. The supplied CVSS 4.0 vector marks VA:N, but the described account lockout capability implies at least partial availability impact that the provided vector likely understates - defenders should not dismiss this signal. No EPSS score was provided and CISA KEV listing is absent, so exploitation probability cannot be numerically quantified; however, the publicly available proof-of-concept materially reduces the skill threshold, making any unpatched instance an accessible target for low-sophistication attackers. The privilege escalation path - converting a member-creation account into full administrative credentials - effectively transforms a low-privilege foothold into complete system control, meaning the real-world impact exceeds what a literal reading of PR:L alone would imply.

An attacker with a standard Dolibarr account granted member-creation rights - a permission routinely issued to non-administrative staff or volunteers - sends a crafted POST request to the Members REST API specifying the administrator's user ID and a chosen password in the request body. The API applies the credential change without checking password-change permissions, allowing the attacker to authenticate as the administrator moments later while the legitimate administrator is locked out. A public proof-of-concept demonstrating this technique is available at https://codeant.ai/security-research/cve-2026-71504-mass-assignment-in-members-api-via-pass.