EUVD-2026-65076
GHSA-fffg-262f-xqrp
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-reachable API requires only a low-privilege account; A:L added over the supplied vector to account for the explicit account lockout capability described.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
Lifecycle Timeline
3DescriptionCVE.org
Dolibarr before 24.0.0 contains an improper authorization vulnerability in the Members REST API that allows attackers with only member-creation rights to reset the password of any user account, including the system administrator, without verifying password-change permissions. Attackers can supply an arbitrary user account identifier and new password in the request body to overwrite credentials and immediately lock out the legitimate account holder.
AnalysisAI
Improper authorization in Dolibarr's Members REST API (all versions before 24.0.0) allows any authenticated user holding member-creation rights to overwrite the password of any system account - including the administrator - without possessing password-change permissions. The attacker supplies an arbitrary user identifier and replacement password in the API request body, immediately gaining control of the target account and locking out its legitimate holder. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | The attacker must possess a valid, authenticated Dolibarr account with member-creation rights, confirmed by the CVSS PR:L metric. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 4.0 base score of 8.6 (AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N) reflects a network-exploitable flaw requiring only a low-privilege authenticated account, no user interaction, and no special attack conditions, with high confidentiality and integrity impact to the vulnerable system. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade Dolibarr to version 24.0.0 or later, which incorporates the authorization fix in commit fbf476cc5d9a21b16bfa04ab17d4e84eda38d7ce; the release is available at https://github.com/Dolibarr/dolibarr/releases/tag/24.0.0. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: Identify your current Dolibarr version, audit which users hold member-creation rights, and temporarily restrict REST API access if operationally feasible. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
SQL injection vulnerability in Dolibarr before 7.0.2 allows remote attackers to execute arbitrary SQL commands via vecto
Dolibarr before 11.0.5 allows low-privilege users to upload files of dangerous types, leading to arbitrary code executio
The admin panel in Dolibarr before 7.0.2 might allow remote attackers to execute arbitrary commands by leveraging suppor
Incorrect authorization in Dolibarr's payments REST API delete endpoint exposes all payment records to deletion by any a
SQL injection in Dolibarr ERP/CRM through version 23.0.3 lets authenticated REST API users exfiltrate arbitrary database
Improper authorization in Dolibarr's expense report REST API update endpoint allows authenticated users with only expens
Dolibarr's Members REST API before version 24.0.0 exposes bcrypt password hash verifiers to any authenticated user holdi
SQL injection in Dolibarr's users REST API (all versions before 24.0.0) allows authenticated users holding only user-rea
Dolibarr's REST API user-update endpoint permits any low-privileged account holding user-write rights to overwrite payro
Broken object-level authorization (BOLA) in Dolibarr's REST API bank account write routes permits any authenticated user
Broken object-level authorization (BOLA) in Dolibarr's REST API write routes for third-party site accounts allows any au
Multiple SQL injection vulnerabilities in Dolibarr ERP/CRM before 3.6.1 allow remote authenticated users to execute arbi
Same weakness CWE-862 – Missing Authorization
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today