Executive brief
Dolibarr is an open-source ERP and CRM system used by organizations to manage business operations. A vulnerability in the user management REST API allows attackers with basic user-write permissions to modify sensitive payroll fields (salary, bonuses, hourly rates) without holding proper payroll administrator rights. An attacker could manipulate payroll data for any employee, causing incorrect salary payments, financial records, and audit trail corruption.
Technical details
This is a mass-assignment / privilege escalation vulnerability in the user REST API update endpoint (api_users.class.php). The vulnerability exists because the endpoint's credential denylist is incomplete—it fails to protect payroll-related fields (salary, bonus, hourly_rate, daily_rate, weekly_hours) from modification by users holding only user-write rights. An attacker with user-write permissions can send a crafted REST API request to modify these payroll fields for any user. The modified payroll data subsequently appears in payroll export reports. The vulnerability was patched in Dolibarr 24.0.0 by adding proper permission guards on salary field access.
Affected products
- Dolibarr Dolibarr before 24.0.0
Timeline
- 2026-08-24: disclosed
- 2026: patched: Fixed in version 24.0.0 with commit c85d0e8