CVE-2026-71510

Name of the Vulnerable Software and Affected Versions Dolibarr versions prior to 24.0.0

Description An issue exists in the users REST API where authenticated attackers with user-read rights can extract sensitive data. This occurs because unsanitized filter parameters are spliced into SQL WHERE clauses without column restrictions. Attackers can use binary search on numeric fields and LIKE prefix iteration on string fields to recover password verifiers and salary figures that are typically omitted from API responses. Additionally, raw database error messages in the same endpoint allow for column name enumeration.

Recommendations Update to version 24.0.0 or later.