Dolibarr EUVD-2026-65084

Exploitation requires an active authenticated session in Dolibarr with at minimum the member-read role, which is a low-privilege built-in role within the platform. The Members REST API module must be active and network-accessible, which is a standard configuration for Dolibarr deployments that expose the REST API. No non-default configuration, special protocol, or elevated privilege beyond member-read is required to trigger the data exposure. Exploitation is bounded by the authentication requirement (PR:L per CVSS 4.0): unauthenticated external attackers cannot directly exploit this flaw without first obtaining credentials. Downstream impact is further constrained by the bcrypt work factor, meaning accounts with strong passwords present a significantly higher cracking cost. No user interaction is required once the attacker holds a qualifying session.

The CVSS 4.0 score of 7.1 with vector AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N reflects an accurate picture: the vulnerability is network-reachable, requires no special attack conditions, and demands only low-privilege authentication, with high confidentiality impact limited to the vulnerable system. The CVSS metrics are internally consistent with the description - a low-trust authenticated user (PR:L) can retrieve credential material over the network (AV:N) with no complexity (AC:L). No EPSS data was supplied, so exploitation probability cannot be quantified precisely; however, the confirmed availability of a public proof-of-concept meaningfully elevates practical risk beyond the theoretical. The absence of a CISA KEV listing suggests no confirmed widespread in-the-wild exploitation at time of analysis, but the low exploitation bar (any member-read account) and available exploit code mean this should not be deprioritized as a merely theoretical finding. Real-world impact is gated on password strength: bcrypt is computationally expensive, so organizations enforcing strong password policies have partial natural mitigation, but this should not substitute for patching.

An authenticated attacker with a low-privilege Dolibarr account that holds member-read rights issues a GET request to the Members API list endpoint, receiving a JSON response that includes the bcrypt password hash for every member. The attacker exports these hashes and submits them to an offline cracking tool such as Hashcat with a rockyou-derived wordlist and common rule sets. Accounts protected by weak or reused passwords are compromised within hours, potentially including administrator accounts if those users are also registered as members, granting the attacker escalated access within Dolibarr or connected systems. A public proof-of-concept demonstrating this technique is available per the cveorg exploit reference.