Quick answers
- Is CVE-2026-71508 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-71508 being exploited in the wild.
- How severe is CVE-2026-71508?
- Medium severity, with a CVSS score of 6.5, published 24 August 2026.
- Which products and versions are affected?
- Dolibarr before 24.0.0.
- Is there a fix for CVE-2026-71508?
- A patch was published on 2026: Fixed in version 24.0.0 with commit c85d0e8 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2026-71508 attacked?
- It is attacked over the network, in a web application.
- Am I affected by CVE-2026-71508?
- Check whether you run Dolibarr at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
This is a mass-assignment / privilege escalation vulnerability in the user REST API update endpoint (api_users.class.php). The vulnerability exists because the endpoint's credential denylist is incomplete—it fails to protect payroll-related fields (salary, bonus, hourly_rate, daily_rate, weekly_hours) from modification by users holding only user-write rights. An attacker with user-write permissions can send a crafted REST API request to modify these payroll fields for any user. The modified payroll data subsequently appears in payroll export reports. The vulnerability was patched in Dolibarr 24.0.0 by adding proper permission guards on salary field access.
Affected products
- Dolibarr Dolibarr before 24.0.0
Timeline
- 2026-08-24: disclosed
- 2026: patched: Fixed in version 24.0.0 with commit c85d0e8