Medium severity · published Aug 24, 2026
CVE-2026-71510
Dolibarr < 24.0.0 Users REST API SQL Injection via filter parameter
6.5
CVSS
0.4%
EPSS
No
On KEV
Description
Dolibarr before 24.0.0 contains a SQL injection vulnerability in the users REST API that allows authenticated attackers with user-read rights to extract sensitive data by splicing unsanitized filter parameters into SQL WHERE clauses without column restrictions. Attackers can perform binary search on numeric fields and LIKE prefix iteration on string fields to recover salary figures and password verifiers omitted from normal API responses, while raw database error messages in the same endpoint enable column name enumeration.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.4% · higher than 32% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
DO
dolibarr · Dolibarr
before 24.0.0 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-71510
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-71510
technical-description
https://codeant.ai/security-research/cve-2026-71510-blind-column-extraction-via-sqlfilters
release-notes
https://github.com/Dolibarr/dolibarr/releases/tag/24.0.0
patch
https://github.com/Dolibarr/dolibarr/commit/12687f83705c2a1e46aaf6f8d1ac7347bee4710c
third-party-advisory
https://www.vulncheck.com/advisories/dolibarr-users-rest-api-sql-injection-via-filter-parameter
More from dolibarr
9.8
CVE-2019-19212
Dolibarr ERP/CRM 3.0 through 10.0.3 allows XSS via the qty parameter to product/fournisseurs.php (product price screen)
9.8
CVE-2018-16809
An issue was discovered in Dolibarr through 7.0.0
9.8
CVE-2018-9019
SQL Injection vulnerability in Dolibarr before version 7.0.2 allows remote attackers to execute arbitrary SQL commands via the sortfield parameter to…
9.8
CVE-2018-10094
SQL injection vulnerability in Dolibarr before 7.0.2 allows remote attackers to execute arbitrary SQL commands via vectors involving integer parameters without quotes
9.8
CVE-2017-14242
SQL injection vulnerability in don/list.php in Dolibarr version 6.0.0 allows remote attackers to execute arbitrary SQL commands via the statut parameter