CVE-2026-71508

Name of the Vulnerable Software and Affected Versions Dolibarr versions prior to 24.0.0

Description An improper authorization issue exists in the user REST API update endpoint. Attackers possessing user-write permissions can modify payroll-related data by exploiting an incomplete credential denylist that fails to include payroll columns. This allows the unauthorized modification of the salary, bonus, hourly rate, daily rate, and weekly hours variables for any user, regardless of whether the attacker has payroll rights. These altered values are subsequently reflected in payroll export reports.

Recommendations Update to version 24.0.0 or later. Restrict access to the user REST API update endpoint to minimize the risk of unauthorized data modification.