Sensitive Data Exposure in Dolibarr Members API

Executive Summary

CVE-2026-71511 is a sensitive data exposure vulnerability in Dolibarr before version 24.0.0. It affects the Members REST API, allowing authenticated attackers with member-read rights to retrieve bcrypt password verifiers by querying member endpoints. The password verifier fields are not filtered by the API serializer or Members API class, enabling potential offline password cracking attacks.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, check if your Dolibarr instance is running a version prior to 24.0.0. Use the command: curl -s http://your-dolibarr-url/htdocs/version.php | grep 'DOLIBARR_VERSION'

Test the API endpoints for exposed password hashes. Use: curl -X GET http://your-dolibarr-url/api/index.php/members/[member_id] -H 'DOLAPIKEY: your_api_key' | grep 'pass_indatabase_crypted'

Useful 0 Not Useful 0

Impact Analysis

This vulnerability allows attackers to obtain bcrypt password hashes of users with member-read permissions. While the data is hashed, weak or reused passwords could be cracked offline, leading to unauthorized access to user accounts. Exploitation requires only low-privilege read access, typically granted to roles like membership secretaries.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could potentially impact compliance with GDPR and HIPAA by exposing sensitive password data through the Members REST API. GDPR requires protection of personal data, including credentials, while HIPAA mandates safeguarding protected health information. The exposure of bcrypt password verifiers may violate these standards if user data is compromised.

Useful 0 Not Useful 0

Mitigation Strategies

Upgrade Dolibarr to version 24.0.0 or later immediately. Remove unnecessary read-members permissions from users who do not require them.

Review API responses for any exposed password hashes by testing member endpoints as described in detection steps.

Useful 0 Not Useful 0