CVE-2026-71508 Dolibarr CVE debrief

Who should care

System administrators and security teams responsible for Dolibarr installations should assess exposure and prioritize remediation to prevent unauthorized changes to payroll data. This includes verifying Dolibarr version, restricting user-write rights, and monitoring payroll export reports for suspicious activity.

Why it matters

CVE-2026-71508 is a high-severity vulnerability in Dolibarr's user REST API update endpoint, allowing attackers to modify payroll fields without proper authorization. System administrators and security teams should assess exposure and prioritize remediation to prevent unauthorized changes to payroll data.

• Verify Dolibarr version and restrict user-write rights to prevent unauthorized payroll modifications
• Monitor payroll export reports for suspicious activity
• Update Dolibarr to version 24.0.0 or later to fix the vulnerability

Technical summary

The vulnerability exists in Dolibarr's user REST API update endpoint, allowing attackers with user-write rights to modify payroll fields by exploiting an incomplete credential denylist. This could lead to unauthorized changes in salary, bonus, hourly rate, daily rate, and weekly hours for any user. The vulnerability has a high severity with a CVSS score of 7.1 and is classified as HIGH. Dolibarr versions before 24.0.0 are affected, and updating to version 24.0.0 or later fixes the vulnerability. System administrators and security teams should assess exposure and prioritize remediation.

Defensive priority

High

Recommended defensive actions

• Review and update Dolibarr to version 24.0.0 or later
• Restrict user-write rights to only necessary personnel
• Monitor payroll export reports for unauthorized changes
• Verify Dolibarr version and restrict user-write rights to prevent unauthorized payroll modifications
• Update Dolibarr to version 24.0.0 or later to fix the vulnerability
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Track exceptions, retest remediated assets, and close the item only after evidence is documented

Evidence notes

The CVE record and NVD entry provide details on the improper authorization vulnerability in Dolibarr's user REST API update endpoint. The vulnerability allows attackers with user-write rights to modify payroll fields for any user without holding payroll rights. Evidence is limited to CVE and NVD entries; further verification is recommended.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.