Dolibarr CVE-2026-71509

Exploitation requires a valid Dolibarr account with expense-creation (expense submission) rights - no approval right is needed. The Dolibarr instance must have the expense reports module enabled and the REST API must be reachable by the attacker. No special network position beyond authenticated REST API access is required (AV:N, AC:L, AT:N per the CVSS 4.0 vector). Exploitation is limited by the authentication prerequisite (PR:L): unauthenticated external attackers cannot exploit this without valid credentials. The impact is scoped to financial workflow integrity - there is no code execution, no data exfiltration path, and no availability impact. Organizations that have disabled the expense module or have not exposed the REST API externally face reduced risk.

The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N) scores 7.1, reflecting network-accessible exploitation by any low-privileged authenticated user with no special attack conditions and high integrity impact. There is no confidentiality or availability component. The CVSS 4.0 signal is consistent with the description: this is not a remote code execution or data exfiltration path - it is a financial workflow bypass. The absence of a CISA KEV listing suggests no confirmed widespread active exploitation at time of analysis, but a publicly available exploit lowers the bar for adversaries significantly. The real-world risk is concentrated in organizations using Dolibarr's expense module for internal financial controls: a malicious or colluding employee could approve fraudulent expense claims without detection, and the corrupted audit trail makes forensic investigation harder. For organizations not using the expense module, the attack surface is effectively zero. No EPSS score was provided; given the authenticated prerequisite and domain-specific impact, opportunistic mass exploitation is unlikely, but insider threat and targeted fraud scenarios are credible.

An employee with standard expense-submission rights authenticates to Dolibarr's REST API and sends a crafted PATCH or PUT request to the expense report update endpoint, including fields such as approval status set to 'approved' and an arbitrary approver identity. Because the endpoint lacks authorization checks on those fields, the server applies the changes without verifying the caller holds approval rights. The employee's fraudulent expense report is immediately marked approved with a spoofed approver, bypassing managerial review; a publicly available proof-of-concept demonstrates this exact flow.