Executive brief
Dolibarr is a popular open-source ERP and CRM system. A flaw in the Members REST API exposes bcrypt password hashes to any authenticated user with member-read permissions. Attackers can retrieve these hashes and perform offline password cracking attacks, potentially compromising member accounts and accessing sensitive business data.
Technical details
The vulnerability is a sensitive data exposure flaw in the Members REST API. The root cause is improper filtering in the base API serializer and Members API class, which fails to remove the "pass_indatabase_crypted" field from API responses. An authenticated attacker with member-read rights can call member list or individual member endpoints to retrieve bcrypt password verifiers that should not be exposed. This enables offline brute-force or dictionary attacks against member credentials. The fix is patched in Dolibarr 24.0.0 and later, which removes the crypted password field from API serialization.
Affected products
- Dolibarr Dolibarr before 24.0.0
Timeline
- 2026-08-24: disclosed
- 2026: patched: Fixed in version 24.0.0