CVE-2026-71508 Dolibarr < 24.0.0 REST API Improper Authorization via User Update Endpoint

Dolibarr before 24.0.0 contains an improper authorization vulnerability in the user REST API update endpoint that allows attackers with user-write rights to modify payroll fields by exploiting an incomplete credential denylist that omits payroll columns. Attackers can rewrite salary, bonus, hourl...

PT-2026-81003

Name of the Vulnerable Software and Affected Versions Dolibarr versions prior to 24.0.0 Description An improper authorization issue exists in the user REST API update endpoint. Attackers possessing user-write permissions can modify payroll-related data by exploiting an incomplete credential...