CVE-2026-71508

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2026-71508

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-71508.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2026-71508

Published

2026-08-24T19:03:59.694Z

Modified

2026-08-27T11:47:33.830452473Z

Severity

7.1 (High) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N CVSS Calculator

Summary

Dolibarr < 24.0.0 REST API Improper Authorization via User Update Endpoint

Details

Dolibarr before 24.0.0 contains an improper authorization vulnerability in the user REST API update endpoint that allows attackers with user-write rights to modify payroll fields by exploiting an incomplete credential denylist that omits payroll columns. Attackers can rewrite salary, bonus, hourly rate, daily rate, and weekly hours for any user without holding payroll rights, with the modified values appearing in payroll export reports.

Database specific

{
    "cna_assigner": "VulnCheck",
    "cwe_ids": [
        "CWE-862"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/71xxx/CVE-2026-71508.json"
}

References

Affected packages

Git / github.com/dolibarr/dolibarr

Affected ranges

Type

GIT

Repo

https://github.com/dolibarr/dolibarr

Events

Introduced

Fixed

769c7db907099643558e77d7002c109cfda919e5

Fixed

c85d0e840725a3c1a2f49b3e97766469c3cb02b6

Database specific

Show details

{
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "fixed": "24.0.0"
        }
    ],
    "source": [
        "DESCRIPTION",
        "REFERENCES"
    ]
}

Affected versions

14.*

14.0.0

14.0.1

3.*

3.3.beta1_20121221

3.4.beta1_20130429

3.4.beta1_20130502

3.5.beta1_20131106

3.5.beta1_20131120

3.6.0

3.6.0-alpha

3.6.0-beta

3.6.1

3.6.2

3.6.beta1_20140514

3.7.0

3.7.1

3.8.0-beta

4.*

4.0.0-rc

5.*

5.0.0-beta

6.*

6.0.0-beta

Other

lne_audit_init_20260601

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-71508.json"