CVE-2026-71504
Dolibarr before 24.0.0 contains an improper authorization vulnerability in the Members REST API that allows attackers with only member-creat
CVSS
8.1
High
EPSS
—
KEV
—
Exploit Today
0
0-100
Published: Aug 24, 2026 · Last modified: Aug 24, 2026 · CWE-862 · CWE-915
Not enough EPSS history yet.
Dolibarr before 24.0.0 contains an improper authorization vulnerability in the Members REST API that allows attackers with only member-creation rights to reset the password of any user account, including the system administrator, without verifying password-change permissions. Attackers can supply an arbitrary user account identifier and new password in the request body to overwrite credentials and immediately lock out the legitimate account holder.
- codeant.aihttps://codeant.ai/security-research/cve-2026-71504-mass-assignment-in-members-api-via-pass
- github.comhttps://github.com/Dolibarr/dolibarr/commit/fbf476cc5d9a21b16bfa04ab17d4e84eda38d7ce
- github.comhttps://github.com/Dolibarr/dolibarr/releases/tag/24.0.0
- www.vulncheck.comhttps://www.vulncheck.com/advisories/dolibarr-members-rest-api-improper-authorization-via-password-reset
CVECVSSEPSSKEVRExploitTitleMod.
CVE-2026-782666.5 MED—
——0Subscriber Broken Access Control in AutomatorWP <= 5.8.3 versions.18hCVE-2026-273646.5 MED—
——0Subscriber Broken Access Control in Style Kits <= 2.6.5 versions.18hCVE-2026-715096.5 MED—
——0Dolibarr before 24.0.0 contains an improper authorization vulnerability in the expense report REST API update endpoint that allows authenticated attackers with expense-creation rights to bypass the approval workflow by directly setting approval status and approver identity fields. Attackers can manipulate workflow state fields through the REST API to advance expense reports to approved or closed status without possessing the dedicated approval right, while also creating forensic inconsistencies in audit records due to missing approval timestamps.21hCVE-2026-715086.5 MED—
——0Dolibarr before 24.0.0 contains an improper authorization vulnerability in the user REST API update endpoint that allows attackers with user-write rights to modify payroll fields by exploiting an incomplete credential denylist that omits payroll columns. Attackers can rewrite salary, bonus, hourly rate, daily rate, and weekly hours for any user without holding payroll rights, with the modified values appearing in payroll export reports.20hCVE-2026-719339.1 CRI—
——0Multiple DrayTek VigorSwitch models contain unauthorized operation vulnerabilities in multiple syslog functions. The vulnerability is caused by missing authorization checks. A remote attacker can trigger these vulnerabilities via crafted requests to modify configuration, restart services, save startup configuration, or clear logs.22hCVE-2026-78416——
——0Craft CMS versions from 4.0.0-RC1 before 4.18.2 and from 5.0.0-RC1 before 5.10.6 contain an authenticated remote code execution vulnerability in control panel element-search condition handling. A JSON cleanse bypass in condition.config allows Yii behavior/event configuration keys to be interpreted after decoding, enabling command execution as the PHP/web user.12h