High severity · published Aug 24, 2026
CVE-2026-71504
Dolibarr < 24.0.0 Members REST API Improper Authorization via Password Reset
8.1
CVSS
0.5%
EPSS
No
On KEV
Description
Dolibarr before 24.0.0 contains an improper authorization vulnerability in the Members REST API that allows attackers with only member-creation rights to reset the password of any user account, including the system administrator, without verifying password-change permissions. Attackers can supply an arbitrary user account identifier and new password in the request body to overwrite credentials and immediately lock out the legitimate account holder.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
High
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.5% · higher than 40% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
DO
dolibarr · Dolibarr
before 24.0.0 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-71504
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-71504
technical-description
https://codeant.ai/security-research/cve-2026-71504-mass-assignment-in-members-api-via-pass
release-notes
https://github.com/Dolibarr/dolibarr/releases/tag/24.0.0
patch
https://github.com/Dolibarr/dolibarr/commit/fbf476cc5d9a21b16bfa04ab17d4e84eda38d7ce
third-party-advisory
https://www.vulncheck.com/advisories/dolibarr-members-rest-api-improper-authorization-via-password-reset
More from dolibarr
9.8
CVE-2019-19212
Dolibarr ERP/CRM 3.0 through 10.0.3 allows XSS via the qty parameter to product/fournisseurs.php (product price screen)
9.8
CVE-2018-16809
An issue was discovered in Dolibarr through 7.0.0
9.8
CVE-2018-9019
SQL Injection vulnerability in Dolibarr before version 7.0.2 allows remote attackers to execute arbitrary SQL commands via the sortfield parameter to…
9.8
CVE-2018-10094
SQL injection vulnerability in Dolibarr before 7.0.2 allows remote attackers to execute arbitrary SQL commands via vectors involving integer parameters without quotes
9.8
CVE-2017-14242
SQL injection vulnerability in don/list.php in Dolibarr version 6.0.0 allows remote attackers to execute arbitrary SQL commands via the statut parameter