CVE-2026-71504

High

Description

Dolibarr before 24.0.0 contains an improper authorization vulnerability in the Members REST API that allows attackers with only member-creation rights to reset the password of any user account, including the system administrator, without verifying password-change permissions. Attackers can supply an arbitrary user account identifier and new password in the request body to overwrite credentials and immediately lock out the legitimate account holder.

SeverityHigh

CVSS8.1

Exploit probability—

ProductDolibarr

PublishedAug 24, 2026

First seenAug 24, 2026

Weakness typeCWE-862Missing authorization CWE-915CWE-915

How to fix

Update

Dolibarr dolibarr24.0.0 or later

Patches

github.com/Dolibarr/dolibarr/commit/fbf476cc5d9a21b16bfa04ab17d4e84eda38d7ce

Vendor advisories

github.com/Dolibarr/dolibarr/releases/tag/24.0.0

Affected products

Product	Affected versions	Fixed in
Dolibarr dolibarr	v < 24.0.0	24.0.0

Check your version

Choose the product and enter the version you run to see whether it falls in the affected range.

In the Intelligence 360 plan

Attack Surface Management

See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.