CVE-2026-71510 Dolibarr CVE debrief

Who should care

Defenders responsible for Dolibarr installations, especially those with user-read rights, should assess exposure and prioritize verification and compensating controls. This includes verifying Dolibarr version and exposure, restricting user-read rights to minimize potential data extraction, and implementing compensating controls to limit API access. Additionally, defenders should review relevant monitoring, detection, and logs for exposed assets that need

Why it matters

CVE-2026-71510 is a SQL injection vulnerability in Dolibarr's users REST API that allows authenticated attackers to extract sensitive data. Defenders should prioritize verifying exposure, assessing potential data extraction, and applying compensating controls to limit API access.

• Potential data extraction through SQL injection
• Need for verification of Dolibarr version and exposure
• Prioritization of compensating controls to limit API access
• Monitoring API activity for suspicious requests

Technical summary

The vulnerability allows authenticated attackers with user-read rights to extract sensitive data by splicing unsanitized filter parameters into SQL WHERE clauses without column restrictions. This enables attackers to perform binary search on numeric fields and LIKE prefix iteration on string fields to recover sensitive information, such as salary figures and password verifiers. The vulnerability also allows attackers to enumerate column names through raw database error messages. To mitigate this vulnerability, defenders should prioritize verifying exposure, assessing potential data extraction, and applying compensating controls to limit API access.

Defensive priority

Defenders should prioritize verifying exposure and assessing potential data extraction, especially for systems with user-read rights, and apply compensating controls to limit API access.

Recommended defensive actions

• Verify Dolibarr version and ensure it is 24.0.0 or later
• Restrict user-read rights to minimize potential data extraction
• Implement compensating controls to limit API access
• Monitor API activity for suspicious requests
• Review relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.

Evidence notes

The CVE record and NVD entry provide details on the SQL injection vulnerability in Dolibarr's users REST API, allowing authenticated attackers to extract sensitive data. The vulnerability is exploitable due to unsanitized filter parameters in SQL WHERE clauses, enabling attackers to perform binary search and LIKE prefix iteration to recover sensitive information. The CVE record and NVD entry also highlight the importance of verifying Dolibarr version and exposure, as well as implementing compensating controls to limit API access. To

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.