Improper Authorization in Dolibarr Expense Report REST API

Executive Summary

CVE-2026-71509 is an improper authorization vulnerability in Dolibarr's Expense Reports REST API. It allows authenticated users with expense-creation rights to bypass the approval workflow by directly modifying approval status and approver identity fields through the API. This enables unauthorized state changes to expense reports without proper permission checks.

Useful 0 Not Useful 0

Detection Guidance

Check Dolibarr versions prior to 24.0.0 for unauthorized approvals in expense reports. Review API logs for POST/PUT requests to /api/expensereports/ that modify fk_statut or fk_user_approve fields. Look for inconsistent audit trails where approval timestamps are missing despite status changes.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability allows users to self-approve their own expense claims or those of subordinates without proper authorization. This could lead to unauthorized financial transactions, potential financial fraud, and forensic inconsistencies in audit records due to missing approval timestamps.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could impact compliance by allowing unauthorized approvals of expense reports, which may violate financial audit requirements and internal control policies. It may also create inconsistencies in audit trails, potentially failing compliance checks for standards requiring proper authorization and record-keeping.

Useful 0 Not Useful 0

Mitigation Strategies

Upgrade Dolibarr to version 24.0.0 or later to apply the official fix. Temporarily restrict API access to trusted users until patching. Monitor expense reports for unauthorized status changes or approvals. Review and validate all recent expense approvals for anomalies.

Useful 0 Not Useful 0