Improper Authorization in Dolibarr User REST API Leading to Payroll Data Manipulation

Executive Summary

CVE-2026-71508 is an improper authorization vulnerability in Dolibarr before version 24.0.0. It allows attackers with basic user-write rights to modify payroll fields like salary, bonus, hourly rate, daily rate, and weekly hours for any user through the REST API update endpoint. The flaw exists because the API's deny-list omits payroll columns, enabling unauthorized changes that appear in payroll export reports.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, check Dolibarr versions prior to 24.0.0. Review API logs for unauthorized modifications to user payroll fields like salary, bonus, hourly rate, daily rate, or weekly hours. Look for API calls to user update endpoints with suspicious payloads containing payroll-related parameters.

Useful 0 Not Useful 0

Impact Analysis

If exploited, this vulnerability could allow unauthorized users to alter payroll data, leading to incorrect salary payments, bonus adjustments, or hourly rate changes. These modifications may go unnoticed initially but will appear in payroll reports, potentially causing financial discrepancies, compliance violations, or disputes with employees.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to non-compliance with GDPR (data accuracy, integrity) and HIPAA (protected health information integrity) by allowing unauthorized modifications to sensitive payroll data. Incorrect payroll records may violate regulatory requirements for data accuracy and security.

Useful 0 Not Useful 0

Mitigation Strategies

Upgrade Dolibarr to version 24.0.0 or later to apply the patch. Review and restrict user permissions to ensure only authorized personnel can modify payroll fields. Monitor API access logs for unusual activity related to user updates.

Useful 0 Not Useful 0