Description

Dolibarr before 24.0.0 contains an improper authorization vulnerability in the Members REST API that allows attackers with only member-creation rights to reset the password of any user account, including the system administrator, without verifying password-change permissions. Attackers can supply an arbitrary user account identifier and new password in the request body to overwrite credentials and immediately lock out the legitimate account holder.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.1",
  "pubDate": "2026-08-24T19:16:49.670Z",
  "pubdate": "2026-08-24T19:16:49.670Z",
  "executiveSummary": "Dolibarr before 24.0.0 suffers from an improper authorization vulnerability residing within the Members REST API endpoint.\nThe vulnerability allows remote attackers possessing restricted privileges—specifically member-creation rights—to execute unauthorized credential resets against arbitrary user accounts, including high-privileged system administrators.\nThe primary business and operational impact involves complete account takeover, immediate denial of service for legitimate users via credential invalidation, and potential unauthorized elevation of privilege across affected Dolibarr deployments.\nThe flaw stems from a failure of the application logic to adequately verify whether an authenticated principal holds the necessary administrative permissions to modify user passwords during API interaction.\nExploitation requires low privileges, specifically the ability to authenticate with member-creation rights, and involves supplying an arbitrary user account identifier alongside a new password payload directly into the HTTP request body.\nGiven the severity of potential administrative compromise, organizations utilizing vulnerable Dolibarr versions face critical risk exposure until remediation is applied.",
  "technicalDetails": "The vulnerability is classified as an improper authorization flaw localized within the Members REST API component of Dolibarr versions prior to 24.0.0.\nThe root cause of the issue is the absence of robust access control checks and role validation routines within the API endpoint handlers responsible for processing member-related operations.\nSpecifically, the API logic fails to enforce permission boundaries, allowing a user authenticated with baseline member-creation privileges to bypass intended authorization checks governing password management functionalities.\nThe attack flow proceeds as follows: First, an attacker establishes an authenticated session or utilizes existing credentials that grant minimal member-creation rights within the Dolibarr instance. Second, the attacker interacts with the Members REST API by dispatching a crafted HTTP request containing the targeted user account identifier (such as a username or user ID) and a replacement password string within the request body. Third, the backend API endpoint processes the input parameters without validating if the session initiator possesses administrative or self-service password-change privileges for the specified target. Finally, the application overwrites the existing credential hash in the underlying database with the attacker-supplied value.\nThis payload behavior immediately neutralizes the authentic account holder's access, effectively locking them out of the system while granting the attacker immediate unauthorized access if the targeted account holds elevated privileges.\nThe vulnerability is exposed over the network via the application's REST API interface and requires valid low-level credentials with member-creation capabilities, eliminating the requirement for unauthenticated network exposure while still presenting a significant internal or low-barrier external threat vector."
}