Description

Dolibarr before 24.0.0 contains an improper authorization vulnerability in the user REST API update endpoint that allows attackers with user-write rights to modify payroll fields by exploiting an incomplete credential denylist that omits payroll columns. Attackers can rewrite salary, bonus, hourly rate, daily rate, and weekly hours for any user without holding payroll rights, with the modified values appearing in payroll export reports.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.5",
  "pubDate": "2026-08-24T19:16:50.253Z",
  "pubdate": "2026-08-24T19:16:50.253Z",
  "executiveSummary": "An improper authorization vulnerability exists in the user REST API update endpoint of Dolibarr before 24.0.0. The security flaw stems from an incomplete credential and attribute denylist that fails to restrict sensitive payroll-related database columns during API-driven user profile updates. This design oversight enables malicious actors possessing standard user-write privileges to systematically escalate their manipulation capabilities regarding financial records without holding explicit administrative payroll permissions. By exploiting this authorization gap, authenticated attackers can overwrite critical compensation parameters, including base salary, performance bonuses, hourly rates, daily rates, and weekly contracted hours, for any targeted user account within the system. The modified compensation figures are subsequently processed by the application and accurately reflected in official payroll export reports, potentially introducing severe financial discrepancies, internal fraud vectors, and compliance risks. The vulnerability specifically targets the API layer of the Dolibarr platform, lowering the barrier for unauthorized financial data tampering among users who possess generalized user modification rights. Remediation requires updating the affected software or implementing strict input filtering and attribute restriction controls on the vulnerable REST API endpoint to properly enforce least privilege access paradigms over sensitive payroll schemas.",
  "technicalDetails": "The root cause of the vulnerability resides in the access control logic implemented within the user REST API update endpoint of Dolibarr prior to version 24.0.0. Specifically, the API endpoint relies on a denylist mechanism to filter out restricted attributes that standard users lacking elevated privileges should not be permitted to modify. However, this denylist is incomplete, exhibiting a critical omission by failing to include sensitive payroll columns within the restricted attribute set.\nThe vulnerable component is the REST API module responsible for processing user update requests. Attackers require network access to the API and must already authenticate with valid credentials possessing user-write rights. Although these privileges are insufficient to modify payroll configurations through the standard user interface or authorized administrative channels, the deficient input validation and authorization checks in the REST API allow these constraints to be bypassed.\nThe attack flow proceeds as follows: First, the authenticated attacker with user-write permissions formulates an HTTP update request directed at the user REST API endpoint. Within the JSON or form-encoded payload, the attacker injects parameters corresponding to sensitive payroll fields—such as salary, bonus, hourly rate, daily rate, and weekly hours—targeting either their own account or any other arbitrary user account within the Dolibarr instance. Because the server-side update logic checks the incoming parameters against an incomplete denylist, the restricted payroll columns are not blocked or validated against the caller's actual role-based permissions.\nConsequently, the database abstraction layer executes an update query that successfully overwrites the targeted financial columns with the attacker-supplied values. Post-exploitation impact is immediately realized during financial processing routines, as the modified salary, bonus, and rate figures are integrated into internal calculations and subsequently surfaced within official payroll export reports generated by the system. This allows unauthorized compensation inflation or financial data corruption to persist undetected until a comprehensive audit is performed."
}