Dolibarr ERP EUVD-2026-76141

Exploitation requires a valid authenticated Dolibarr session as any user, including standard non-privileged accounts (PR:L per the CVSS 4.0 vector). The sqlfilters query parameter must be accessible on the target API endpoint, which is available in Dolibarr's default REST API configuration. The database backend must perform case-insensitive column resolution, which is the default behavior for MySQL and MariaDB. No special roles, elevated privileges, or non-default configuration are needed beyond possession of a valid user account and network access to the API. The attack is limited to Dolibarr 24.0.0 installations that have not applied commit 7a04d9c; whether earlier versions share the same vulnerable code path is not confirmed from available data.

The CVSS 4.0 vector AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N is well-calibrated: the attack is network-accessible with low complexity, requires authenticated access as any standard user (PR:L), and delivers high confidentiality impact through admin hash extraction. The authentication requirement meaningfully raises the bar compared to unauthenticated flaws, as an attacker must possess a valid account before exploiting the oracle. No CISA KEV listing exists and EPSS data is unavailable, but VulnCheck has reported the issue publicly. The boolean oracle technique is methodical and automatable - an attacker with API access can script full hash extraction without manual interaction, meaning the threat is not merely theoretical for any organization operating Dolibarr with API access exposed. The impact extends beyond the attacker's own account: admin password hashes for all users are reachable, enabling offline cracking and full application takeover. Absence of a KEV listing and no confirmed public exploit code provide some assurance this is not yet actively exploited.

An attacker with any valid Dolibarr account calls the API with sqlfilters containing a predicate such as PASSWORD LIKE 'a%', bypassing the case-sensitive denylist. By iterating through all possible characters for each position and observing boolean differences in the API response (results returned vs. empty), the attacker extracts the full password hash for the administrator account character by character. The recovered hash is then submitted to an offline cracking tool to recover the administrator's plaintext password, enabling full application access.