Description

Dolibarr before 24.0.0 contains an improper authorization vulnerability in the expense report REST API update endpoint that allows authenticated attackers with expense-creation rights to bypass the approval workflow by directly setting approval status and approver identity fields. Attackers can manipulate workflow state fields through the REST API to advance expense reports to approved or closed status without possessing the dedicated approval right, while also creating forensic inconsistencies in audit records due to missing approval timestamps.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.5",
  "pubDate": "2026-08-24T19:16:50.403Z",
  "pubdate": "2026-08-24T19:16:50.403Z",
  "executiveSummary": "An improper authorization vulnerability exists in the expense report REST API update endpoint of Dolibarr before version 24.0.0. This security flaw allows authenticated attackers possessing standard expense-creation rights to completely bypass the established organizational approval workflow.\nBy directly manipulating internal workflow state fields via the REST API, attackers can force expense reports into approved or closed status without holding the requisite administrative approval privileges.\nThe primary impact involves unauthorized state transition manipulation and integrity violations within the financial reporting system, coupled with forensic inconsistencies in audit records due to missing approval timestamps.\nExploitation requires active authentication and initial expense-creation privileges, lowering the necessary attacker capability threshold while leveraging exposed API endpoints.\nThe risk implication is significant for organizations relying on strict segregation of duties for financial oversight, as internal controls governing expense report lifecycles can be subverted programmatically.",
  "technicalDetails": "The root cause of the vulnerability stems from insufficient access control enforcement and parameter filtering within the expense report REST API update endpoint in Dolibarr before version 24.0.0.\nThe vulnerable component is the expense report update functionality exposed via the REST API interface, which fails to validate whether the authenticated user possesses the specific administrative approval rights before processing state-changing modifications.\nAuthentication requirements dictate that the attacker must possess valid credentials and baseline permissions to create expense reports; however, higher-tier authorization checks associated with workflow progression are absent during API update operations.\nPrivilege requirements are restricted to standard authenticated users with expense-creation capabilities, completely bypassing the intended requirement for dedicated approval rights.\nThe attack flow proceeds as follows: First, the authenticated attacker initiates or identifies an existing expense report within the system. Second, the attacker formulates a malicious HTTP request directed at the expense report REST API update endpoint. Third, the payload incorporates explicit parameter assignments for approval status and approver identity fields that would normally be restricted or managed exclusively by internal workflow logic. Fourth, the backend application processes the request without adequately verifying the caller's authorization to alter workflow states. Finally, the expense report status transitions directly to approved or closed.\nPayload behavior involves injecting state variables directly into API parameters, resulting in unauthorized workflow progression and the generation of incomplete audit trails characterized by missing approval timestamps.\nPost-exploitation impact includes compromised financial integrity, subversion of internal compliance controls, and diminished auditability due to forensic anomalies in the expense report tracking records."
}