# CVE-2026-71508: Dolibarr improper authorization in user REST API update endpoint

Source: https://junglewise.ai/threats/cve-2026-71508-dolibarr-improper-authorization-in-user-rest-api-update-endpoint  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-08-24. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-71508 · Severity: medium · CVSS 6.5 · Published 2026-08-24

Dolibarr is an open-source ERP and CRM system used by organizations to manage business operations. A vulnerability in the user management REST API allows attackers with basic user-write permissions to modify sensitive payroll fields (salary, bonuses, hourly rates) without holding proper payroll administrator rights. An attacker could manipulate payroll data for any employee, causing incorrect salary payments, financial records, and audit trail corruption.

Technologies: [Dolibarr](https://junglewise.ai/threats/technologies/dolibarr). Vendors: [Dolibarr](https://junglewise.ai/threats/vendors/dolibarr).

## Quick answers

**Is CVE-2026-71508 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-71508 being exploited in the wild.

**How severe is CVE-2026-71508?** Medium severity, with a CVSS score of 6.5, published 24 August 2026.

**Which products and versions are affected?** Dolibarr before 24.0.0.

**Is there a fix for CVE-2026-71508?** A patch was published on 2026: Fixed in version 24.0.0 with commit c85d0e8 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-71508 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-71508?** Check whether you run Dolibarr at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

This is a mass-assignment / privilege escalation vulnerability in the user REST API update endpoint (api_users.class.php). The vulnerability exists because the endpoint's credential denylist is incomplete—it fails to protect payroll-related fields (salary, bonus, hourly_rate, daily_rate, weekly_hours) from modification by users holding only user-write rights. An attacker with user-write permissions can send a crafted REST API request to modify these payroll fields for any user. The modified payroll data subsequently appears in payroll export reports. The vulnerability was patched in Dolibarr 24.0.0 by adding proper permission guards on salary field access.

## Affected products

- Dolibarr Dolibarr before 24.0.0

## Timeline

- 2026-08-24: disclosed
- 2026: patched: Fixed in version 24.0.0 with commit c85d0e8

## References

- [https://codeant.ai/security-research/cve-2026-71508-dolibarr-payroll-mass-assignment](https://codeant.ai/security-research/cve-2026-71508-dolibarr-payroll-mass-assignment)
- [https://github.com/Dolibarr/dolibarr/commit/c85d0e840725a3c1a2f49b3e97766469c3cb02b6](https://github.com/Dolibarr/dolibarr/commit/c85d0e840725a3c1a2f49b3e97766469c3cb02b6)

## Related threats

- [Dolibarr authorization bypass in expense report payments API](https://junglewise.ai/threats/cve-2026-125754-dolibarr-20-0-0-through-23-0-4-and-24-x-before-24-0-2-contains)
- [Dolibarr CSP mechanism bypass in document.php](https://junglewise.ai/threats/cve-2026-112361-a-vulnerability-has-been-found-in-dolibarr-up-to-23-0-2-the)
- [Dolibarr authorization bypass in document storage endpoints](https://junglewise.ai/threats/cve-2026-89013-dolibarr-authorization-bypass-in-document-storage-endpoints)
- [Dolibarr case-sensitive denylist bypass in sqlfilters API](https://junglewise.ai/threats/cve-2026-89012-dolibarr-case-sensitive-denylist-bypass-in-sqlfilters-api)
- [Dolibarr Legacy File Manager improper access control](https://junglewise.ai/threats/cve-2026-85401-dolibarr-legacy-file-manager-improper-access-control)