Dolibarr CVE-2026-71508

Exploitation requires a valid Dolibarr account that has been explicitly granted the user-write right, which permits modification of user records via the REST API. The attacker does not need payroll-specific role membership - this is the core of the vulnerability. The Dolibarr REST API must be enabled and accessible to the attacker's network location; deployments that disable the REST API entirely are not affected. Unauthenticated exploitation is not possible per the PR:L metric - an account credential is mandatory. Payroll impact is limited to organizations using Dolibarr's salary and payroll module; installations that do not process payroll data through Dolibarr face no meaningful integrity risk from this specific flaw even if exploitable.

The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N) indicates a network-reachable flaw requiring low-privilege authentication with no other attack complexity - meaning any valid Dolibarr account with user-write rights is a potential attack origin. The integrity impact is High (VI:H) with no confidentiality or availability effect, consistent with silent financial data manipulation rather than data theft or service disruption. No EPSS score was provided in the input; exploitation probability is inferred from the low attack complexity and confirmed public POC, which together suggest the barrier to exploitation is very low for insiders or compromised accounts. The absence of a CISA KEV listing means confirmed widespread active exploitation has not been established, but this should not reduce urgency: the financial fraud potential - silently inflating salaries or altering compensation data that flows into official payroll export reports - represents a high-impact business risk that may not surface until reconciliation. The real-world risk is highest in organizations that rely on Dolibarr for payroll processing and have granted user-write API permissions broadly; organizations that do not use the payroll module or have restricted REST API access face meaningfully lower impact.

A publicly available proof-of-concept exists (https://codeant.ai/security-research/cve-2026-71508-dolibarr-payroll-mass-assignment). An authenticated attacker with a Dolibarr account that holds user-write rights sends a crafted REST API request to the user-update endpoint, embedding payroll fields such as salary or bonus in the JSON payload alongside otherwise-legitimate user attributes. Dolibarr's incomplete denylist accepts and persists the payroll field values without verifying payroll-role membership, causing the manipulated compensation figures to appear in subsequent payroll export reports used for salary processing.