Executive brief
Dolibarr is an open-source enterprise resource planning (ERP) system that manages business functions including expense reporting. A vulnerability in the expense report REST API allows authenticated users with basic expense-creation rights to approve their own expense reports without proper authorization, bypassing the required approval workflow and creating audit trail inconsistencies. This could lead to unauthorized financial approvals and compliance violations.
Technical details
The vulnerability is a mass-assignment/improper authorization flaw in the expense report REST API update endpoint (PUT/POST operations). An authenticated attacker with expense-creation permissions can directly manipulate sensitive fields such as approval status and approver identity through the REST API, bypassing the intended approval workflow. The API failed to exclude critical properties from user-controlled input, allowing an attacker to advance an expense report to approved or closed status without possessing the dedicated approval right. The attack requires network access and valid authentication credentials. A patch has been released in Dolibarr 24.0.0 that restricts which properties can be modified through the API.
Affected products
- Dolibarr Dolibarr before 24.0.0
Timeline
- 2026-08-24: disclosed
- 2026: patched: Fixed in Dolibarr 24.0.0