SQL Injection in Dolibarr REST API

Executive Summary

CVE-2026-71510 is a SQL injection vulnerability in Dolibarr's Users REST API affecting versions before 24.0.0. Authenticated attackers with user-read rights can inject unsanitized filter parameters into SQL WHERE clauses to extract sensitive data like salaries and password hashes. The flaw stems from improper handling of search criteria in the forgeSQLFromUniversalSearchCriteria function.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, check if your Dolibarr instance is running a version prior to 24.0.0. Use commands like 'curl -s http://your-dolibarr-url/htdocs/conf/conf.php | grep dolibarr_version' to verify the version. If vulnerable, monitor API responses for raw database errors or unexpected data leaks in user listings.

Useful 0 Not Useful 0

Impact Analysis

Attackers can recover sensitive payroll data (salaries, hourly costs) and password verifiers through binary search attacks on numeric fields and LIKE prefix iteration on strings. Raw database errors enable column name enumeration. While account takeover isn't possible, exposed salary data and password hashes pose privacy and security risks.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability likely violates GDPR's data minimization and security principles by exposing sensitive personal data (salaries, password hashes) and HIPAA's safeguards for protected health information if such data exists in the system. Unauthorized data exposure could lead to regulatory penalties.

Useful 0 Not Useful 0

Mitigation Strategies

Immediately upgrade Dolibarr to version 24.0.0 or later. If upgrading is not possible, restrict access to the Users REST API endpoint and review API permissions to ensure only authorized users can access sensitive data. Disable raw error messages in API responses.

Useful 0 Not Useful 0