CVE-2026-71503

Name of the Vulnerable Software and Affected Versions Dolibarr versions prior to 24.0.0

Description A reflected cross-site scripting issue exists in the extra fields administration template. The type request parameter is echoed into an inline script block without proper JavaScript-context encoding, and the application fails to emit a Content-Security-Policy header. This allows an unauthenticated attacker to trick an authenticated administrator into opening a crafted URL, enabling the execution of arbitrary JavaScript within that session to create a persistent administrator account.

Recommendations Update to version 24.0.0 or later.