CVE-2026-71504
published 2026-08-24CVE-2026-71504: Dolibarr before 24.0.0 contains an improper authorization vulnerability in the Members REST API that allows attackers with only member-creation rights to reset…
PriorityP357high8.1CVSS 3.1
AVNACLPRLUINSUCHIHAN
EPSS
0.46%
38.5th percentile
Dolibarr before 24.0.0 contains an improper authorization vulnerability in the Members REST API that allows attackers with only member-creation rights to reset the password of any user account, including the system administrator, without verifying password-change permissions. Attackers can supply an arbitrary user account identifier and new password in the request body to overwrite credentials and immediately lock out the legitimate account holder.
Affected
1 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| dolibarr | dolibarr | < 24.0.0 | 24.0.0 |
CVSS provenance
nvdv3.18.1HIGHCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
nvdv4.08.6HIGHCVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
Dolibarr before 24.0.0 contains an improper authorization vulnerability in the Members REST API that allows attackers with only member-creation rights to reset the password of any user account, includ
ghsa_unreviewed·2026-08-24
CVE-2026-71504 [HIGH] CWE-862 Dolibarr before 24.0.0 contains an improper authorization vulnerability in the Members REST API that allows attackers with only member-creation rights to reset the password of any user account, includ
Dolibarr before 24.0.0 contains an improper authorization vulnerability in the Members REST API that allows attackers with only member-creation rights to reset the password of any user account, including the system administrator, without verifying password-change permissions. Attackers can supply an arbitrary user account identifier and new password in the request body to overwrite credentials and immediately lock out the legitimate account holder.
VulDB
Dolibarr up to 23.x Members REST API privileges management
vuldb·2026-08-24·CVSS 8.1
CVE-2026-71504 [HIGH] Dolibarr up to 23.x Members REST API privileges management
A vulnerability categorized as critical has been discovered in Dolibarr up to 23.x. This issue affects some unknown processing of the component Members REST API. The manipulation results in improper privilege management.
This vulnerability is cataloged as CVE-2026-71504. The attack may be launched remotely. There is no exploit available.
It is advisable to upgrade the affected component.
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
https://codeant.ai/security-research/cve-2026-71504-mass-assignment-in-members-api-via-passhttps://github.com/Dolibarr/dolibarr/commit/fbf476cc5d9a21b16bfa04ab17d4e84eda38d7cehttps://github.com/Dolibarr/dolibarr/releases/tag/24.0.0https://www.vulncheck.com/advisories/dolibarr-members-rest-api-improper-authorization-via-password-reset
2026-08-24
Published