# CVE-2026-125754: Dolibarr authorization bypass in expense report payments API

Source: https://junglewise.ai/threats/cve-2026-125754-dolibarr-20-0-0-through-23-0-4-and-24-x-before-24-0-2-contains  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-11-10. Updated: 2026-11-10  
License: CC BY 4.0 with a link back

CVE-2026-125754 · Severity: high · CVSS 7.1 · Published 2026-11-10

Dolibarr is an open-source business management software that handles expense report tracking and reimbursements. An authenticated user with limited permissions to view expense reports can bypass authorization checks in the REST API to read, create, or modify payment records for other users' expense reports, allowing them to falsify reimbursement states and potentially commit financial fraud.

Technologies: [Dolibarr](https://junglewise.ai/threats/technologies/dolibarr). Vendors: [Dolibarr](https://junglewise.ai/threats/vendors/dolibarr).

## Quick answers

**Is CVE-2026-125754 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-125754 being exploited in the wild.

**How severe is CVE-2026-125754?** High severity, with a CVSS score of 7.1, published 10 November 2026.

**Which products and versions are affected?** Dolibarr 20.0.0 through 23.0.4, 24.x before 24.0.2.

**Is there a fix for CVE-2026-125754?** Yes: fixed in 24.0.2, and later versions in the 23.x and 20.x branches. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-125754 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-125754?** Check whether you run Dolibarr at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in 24.0.2, and later versions in the 23.x and 20.x branches

## Technical details

An insecure direct object reference (IDOR) vulnerability exists in the API payment endpoints (getAllPayments, getPayments, addPayment, updatePayment) within api_expensereports.class.php. These endpoints check module-level permissions but fail to verify that the authenticated user has access to the parent expense report, allowing horizontal privilege escalation. An attacker needs valid API credentials with expense report read/create rights but no elevated permissions to exploit this.

## Affected products

- Dolibarr Dolibarr 20.0.0 through 23.0.4, 24.x before 24.0.2

## Timeline

- 2026-11-10: disclosed

## References

- [https://github.com/Dolibarr/dolibarr/blob/24.0.1/htdocs/expensereport/class/api_expensereports.class.php](https://github.com/Dolibarr/dolibarr/blob/24.0.1/htdocs/expensereport/class/api_expensereports.class.php)
- [https://github.com/Dolibarr/dolibarr/commit/322026099df5cffcca2fd45dd76193fca601cfd9](https://github.com/Dolibarr/dolibarr/commit/322026099df5cffcca2fd45dd76193fca601cfd9)

## Related threats

- [Dolibarr CSP mechanism bypass in document.php](https://junglewise.ai/threats/cve-2026-112361-a-vulnerability-has-been-found-in-dolibarr-up-to-23-0-2-the)
- [Dolibarr authorization bypass in document storage endpoints](https://junglewise.ai/threats/cve-2026-89013-dolibarr-authorization-bypass-in-document-storage-endpoints)
- [Dolibarr case-sensitive denylist bypass in sqlfilters API](https://junglewise.ai/threats/cve-2026-89012-dolibarr-case-sensitive-denylist-bypass-in-sqlfilters-api)
- [Dolibarr Legacy File Manager improper access control](https://junglewise.ai/threats/cve-2026-85401-dolibarr-legacy-file-manager-improper-access-control)
- [Dolibarr authorization bypass in Users::getGroups REST API](https://junglewise.ai/threats/cve-2026-82633-dolibarr-authorization-bypass-in-users-getgroups-rest-api)