CVE-2026-71509

Name of the Vulnerable Software and Affected Versions Dolibarr versions prior to 24.0.0

Description An improper authorization issue exists in the expense report REST API update endpoint. Authenticated attackers with expense-creation rights can bypass the approval workflow by directly modifying approval status and approver identity fields. This allows the manipulation of workflow state fields to advance expense reports to approved or closed status without the required approval permissions, which also results in forensic inconsistencies in audit records due to the absence of approval timestamps.

Recommendations Update to version 24.0.0 or later. Restrict access to the expense report REST API update endpoint for users who should not have approval authority.