CVE-2026-71504
Received Received - Intake

Improper Authorization in Dolibarr Members REST API Allows Password Reset

Publication date: 2026-08-24

Last updated on: 2026-08-24

Assigner: VulnCheck

Description
Dolibarr before 24.0.0 contains an improper authorization vulnerability in the Members REST API that allows attackers with only member-creation rights to reset the password of any user account, including the system administrator, without verifying password-change permissions. Attackers can supply an arbitrary user account identifier and new password in the request body to overwrite credentials and immediately lock out the legitimate account holder.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-24
Last Modified
2026-08-24
Generated
2026-08-24
AI Q&A
2026-08-24
EPSS Evaluated
N/A
NVD
CVE-2026-71504
EUVD
EUVD-2026-65076

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
dolibarr dolibarr to 24.0.0 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-915 The product receives input from an upstream component that specifies multiple attributes, properties, or fields that are to be initialized or updated in an object, but it does not properly control which attributes can be modified.
CWE-862 The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-71504 is an improper authorization vulnerability in Dolibarr's Members REST API. It allows attackers with basic member-creation rights to reset passwords for any user account, including administrators, without proper permission checks. Attackers can supply a user ID and new password to overwrite credentials and lock out legitimate users.

Detection Guidance

Check Dolibarr version with: grep -r "version" /path/to/dolibarr/documents/ or via the admin panel. Inspect API logs for suspicious POST/PUT requests to /api/index.php/members or /api/index.php/users with password reset attempts. Monitor for unauthorized password changes in user accounts.

Impact Analysis

An attacker could gain full control of the Dolibarr system by resetting the administrator's password. This leads to unauthorized access, data theft, or system manipulation. Even non-admin accounts could be compromised, disrupting operations or causing data loss.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating GDPR's data protection requirements and HIPAA's security rules. Organizations using vulnerable Dolibarr versions may face compliance breaches, legal penalties, and reputational damage due to insufficient access controls.

Mitigation Strategies

Upgrade Dolibarr to version 24.0.0 or later immediately. Review API access logs for signs of exploitation. Restrict API keys to least privilege, especially for membership permissions. Disable password reset via Members API if not required.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-71504. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart