CVE-2026-71504: Dolibarr

High severity, CVSS 8.1. EPSS: 0.5% chance of exploitation in the next 30 days.

Dolibarr before 24.0.0 contains an improper authorization vulnerability in the Members REST API that allows attackers with only member-creation rights to reset the password of any user account, including the system administrator, without verifying password-change permissions. Attackers can supply an arbitrary user account identifier and new password in the request body to overwrite credentials and immediately lock out the legitimate account holder.

Affected products

• Dolibarr Dolibarr: before 24.0.0 (fixed in 24.0.0)

Published 2026-08-24. Last modified 2026-09-08.