EUVD-2026-65080
GHSA-r5vq-mccw-jgvp
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
REST API is network-accessible; low complexity; authenticated low-privilege required (PR:L); no user interaction; integrity is high (IBAN substitution, payment fraud); no confidentiality or availability impact described.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
Lifecycle Timeline
3DescriptionCVE.org
Dolibarr before 24.0.0 contains a broken object-level authorization vulnerability in the REST API company bank account write routes that allows authenticated attackers with third-party creation rights to create, replace, or delete bank account details of any company without requiring read access to that company. Attackers can inject attacker-controlled IBANs as creditor accounts, which are then written into regenerated SEPA credit-transfer files, redirecting outgoing payments to attacker-controlled accounts.
AnalysisAI
Broken object-level authorization (BOLA) in Dolibarr's REST API bank account write routes permits any authenticated user holding third-party creation rights to overwrite bank account details - including IBANs - for any company in the system, regardless of whether they have read access to that company. When SEPA credit-transfer files are subsequently regenerated from the tampered records, outgoing supplier payments are silently redirected to attacker-controlled accounts, enabling financial fraud at scale. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires an authenticated Dolibarr session with at least 'third-party creation' rights - a non-default permission that must be explicitly granted to user accounts, but one that may be broadly assigned in organizations where multiple users manage supplier or customer records. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 4.0 base score of 7.1 (AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N) accurately reflects the core threat model: network-accessible, low complexity, low privilege threshold, no user interaction, and high integrity impact. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade to Dolibarr 24.0.0 immediately; the patched release is confirmed at https://github.com/Dolibarr/dolibarr/releases/tag/24.0.0 and the fixing commit is c100564d059e19c711317c734d302a90b11e2e8b. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, identify all Dolibarr deployments in your infrastructure and confirm which users hold third-party creation rights and whether the REST API is accessible from the network. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
SQL injection vulnerability in Dolibarr before 7.0.2 allows remote attackers to execute arbitrary SQL commands via vecto
Dolibarr before 11.0.5 allows low-privilege users to upload files of dangerous types, leading to arbitrary code executio
Improper authorization in Dolibarr's Members REST API (all versions before 24.0.0) allows any authenticated user holding
The admin panel in Dolibarr before 7.0.2 might allow remote attackers to execute arbitrary commands by leveraging suppor
Incorrect authorization in Dolibarr's payments REST API delete endpoint exposes all payment records to deletion by any a
SQL injection in Dolibarr ERP/CRM through version 23.0.3 lets authenticated REST API users exfiltrate arbitrary database
Improper authorization in Dolibarr's expense report REST API update endpoint allows authenticated users with only expens
Dolibarr's Members REST API before version 24.0.0 exposes bcrypt password hash verifiers to any authenticated user holdi
SQL injection in Dolibarr's users REST API (all versions before 24.0.0) allows authenticated users holding only user-rea
Dolibarr's REST API user-update endpoint permits any low-privileged account holding user-write rights to overwrite payro
Broken object-level authorization (BOLA) in Dolibarr's REST API write routes for third-party site accounts allows any au
Multiple SQL injection vulnerabilities in Dolibarr ERP/CRM before 3.6.1 allow remote authenticated users to execute arbi
Same technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today