Vulnerability Description
Dolibarr before 24.0.0 contains an improper authorization vulnerability in the Members REST API that allows attackers with only member-creation rights to reset the password of any user account, including the system administrator, without verifying password-change permissions. Attackers can supply an arbitrary user account identifier and new password in the request body to overwrite credentials and immediately lock out the legitimate account holder.
CVSS Score
HIGH
Related Weaknesses (CWE)
References
- https://codeant.ai/security-research/cve-2026-71504-mass-assignment-in-members-a
- https://github.com/Dolibarr/dolibarr/commit/fbf476cc5d9a21b16bfa04ab17d4e84eda38
- https://github.com/Dolibarr/dolibarr/releases/tag/24.0.0
- https://www.vulncheck.com/advisories/dolibarr-members-rest-api-improper-authoriz
FAQ
What is CVE-2026-71504?
CVE-2026-71504 is a vulnerability with a CVSS score of 8.1 (HIGH). Dolibarr before 24.0.0 contains an improper authorization vulnerability in the Members REST API that allows attackers with only member-creation rights to reset the password of any user account, includ...
How severe is CVE-2026-71504?
CVE-2026-71504 has been rated HIGH with a CVSS base score of 8.1/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2026-71504?
Check the references section above for vendor advisories and patch information. Review vendor security bulletins for remediation guidance.