CVE-2026-71504: Dolibarr Authentication Bypass Vulnerability

CVE-2026-71504 Overview

CVE-2026-71504 is an improper authorization vulnerability [CWE-862] in Dolibarr ERP/CRM versions before 24.0.0. The flaw resides in the Members REST API, which fails to verify password-change permissions before applying updates to user records. An attacker holding only member-creation rights can send an arbitrary user_id and new password in a request body, overwriting credentials for any user account, including the system administrator. The legitimate account holder is immediately locked out once the credentials change.

Critical Impact
Any authenticated user with member-creation rights can take over the Dolibarr administrator account through a single API request, resulting in full compromise of the ERP/CRM instance.

Affected Products

Dolibarr ERP/CRM versions prior to 24.0.0
Dolibarr Members REST API endpoint (api_members.class.php)
Deployments exposing the Dolibarr REST API to authenticated members

Discovery Timeline

2026-08-24 - CVE-2026-71504 published to NVD
2026-08-27 - Last updated in NVD database

Technical Details for CVE-2026-71504

Vulnerability Analysis

The vulnerability is a mass-assignment flaw in the Dolibarr Members REST API. The create and update handlers in htdocs/adherents/class/api_members.class.php iterate over caller-supplied fields and apply them directly to the underlying member record. The linked user account inherits sensitive fields such as user_id and pass. Because the API only checks that the caller can create or edit members, an attacker with adherent->creer rights can pivot to modifying arbitrary user credentials. The result is authentication bypass through credential overwrite, enabling privilege escalation to the administrator role.

Root Cause

The root cause is missing authorization on sensitive fields inside the Members API handler. The pre-patch code enforced a blocklist for properties that could not be modified, but did not check whether the caller had the user->user->creer permission before allowing user_id linkage or password propagation. Sensitive user attributes were treated as ordinary member attributes.

Attack Vector

Exploitation requires a valid API token bound to any account with member-creation rights. The attacker issues an HTTP POST or PUT to the members endpoint containing a user_id referencing the target account and a pass value. The server writes the supplied password to the linked user record without further authorization checks. The attacker then authenticates as the target user with the new credentials.

php

// Patch: htdocs/adherents/class/api_members.class.php
// This properties can't be set/modified with API
throw new RestException(405, 'The property '.$field." can't be set/modified using the APIs");
}
if (in_array($field, array('user_id') && !DolibarrApiAccess::$user->hasRight('user', 'user', 'creer'))) {
    // This properties can't be set/modified with API without permission user->user->creer
    throw new RestException(405, 'The property '.$field." can't be set/modified using the APIs without permission user->user->create");
}
if ($field === 'caller') {
    // Add a mention of caller so on trigger called after action, we can filter to avoid a loop
    $member->context['caller'] = sanitizeVal($request_data['caller'], 'aZ09');

Source: GitHub commit fbf476c

Detection Methods for CVE-2026-71504

Indicators of Compromise

Unexpected HTTP POST or PUT requests to /api/index.php/members containing user_id or pass fields in the JSON body
Password change events on privileged accounts without a preceding administrator session
Successful logins to administrator accounts from IP addresses previously associated only with low-privileged API tokens
Audit log entries showing member updates immediately followed by user credential modification

Detection Strategies

Enable verbose Dolibarr API logging and alert on request bodies to the members endpoint containing the pass or user_id keys
Correlate dolibarr_user table password hash changes with the identity of the API token that triggered them
Baseline expected API callers per role and flag deviations where a member-creation token modifies user records

Monitoring Recommendations

Forward Dolibarr web server access logs and application logs to a central log platform for retention and correlation
Monitor for lockout events, failed logins, and password reset activity on administrative accounts
Track newly issued API tokens and correlate their usage against expected business workflows

How to Mitigate CVE-2026-71504

Immediate Actions Required

Upgrade Dolibarr to version 24.0.0 or later, which contains commit fbf476c enforcing the user->user->creer check
Rotate all Dolibarr user passwords and API tokens, prioritizing accounts with administrative rights
Review recent Members API activity for unauthorized user_id or pass modifications and revert any unexpected changes
Restrict Members API access to trusted networks until the patched version is deployed

Patch Information

The fix is included in Dolibarr release 24.0.0. The patch in commit fbf476c adds an explicit permission check that rejects modification of the user_id field unless the caller holds the user->user->creer right. Additional context is available in the VulnCheck advisory and the Codeant AI research writeup.

Workarounds

Disable the REST API module in Dolibarr until the upgrade is applied if no business workflow requires it
Revoke adherent->creer permission from accounts that do not require member creation
Place the Dolibarr API behind a reverse proxy that blocks POST and PUT requests to /api/index.php/members containing user_id or pass fields

bash

# Example nginx rule to block risky member API payloads until patched
location /api/index.php/members {
    if ($request_method ~* "(POST|PUT)") {
        set $block 0;
    }
    if ($request_body ~* "\"(user_id|pass)\"") {
        set $block "${block}1";
    }
    if ($block = "01") {
        return 403;
    }
    proxy_pass http://dolibarr_backend;
}