Dolibarr ERP EUVD-2026-65083

The attacker must hold a valid Dolibarr account with user-read API rights (PR:L); unauthenticated exploitation is not possible. The Dolibarr REST API module must be enabled - this is an optional module but commonly activated in integrated deployments - and the users endpoint must be reachable over the network. No other non-default configuration is required; the vulnerable filter-parameter handling is in the standard users API code path. Limiting factors: authentication is required, eliminating anonymous internet exploitation in default deployments; user-read rights must have been explicitly granted. However, user-read is a common baseline role for staff accounts and third-party integrations, so the realistic exploitable population in active Dolibarr deployments is substantial. The attack causes no writes and no service disruption, making it stealthy and likely to evade integrity-focused detection controls.

The CVSS 4.0 score of 7.1 with VC:H accurately reflects the high-value data exposed: password verifiers and salary figures are among the most operationally damaging payloads an ERP system can leak. The low privilege bar (PR:L - any user-read account suffices), combined with low attack complexity (AC:L, AT:N) and a publicly available exploit writeup, makes this a genuine, elevated-priority finding rather than a high-score paper vulnerability. EPSS data was not included in the provided intelligence; exploitation probability cannot be quantified without querying the FIRST EPSS API directly - this gap should be resolved before making triage decisions solely on the CVSS score. No CISA KEV listing was present, suggesting active exploitation has not yet been confirmed at scale, but the public POC substantially lowers the skill threshold for abuse. The combination of insider threat risk (low-privilege insider accounts are common) and third-party integration credentials makes this especially relevant for organizations with large or externally connected Dolibarr deployments. Overall, the absence of KEV status does not substantially reduce urgency given the public exploit and the sensitivity of the extractable data.

An attacker holding a low-privilege Dolibarr account with user-read API rights - obtained via credential stuffing, insider access, or a compromised service integration token - sends crafted requests to the users REST API with malicious filter parameters. By injecting SQL into the WHERE clause, the attacker iterates character-by-character using LIKE prefix queries to reconstruct password verifier strings and uses binary search conditions (e.g., salary > X) to recover salary values, while raw database error responses reveal internal column names that accelerate the extraction. The full technique is publicly documented at https://codeant.ai/security-research/cve-2026-71510-blind-column-extraction-via-sqlfilters, substantially lowering the skill bar.