Description

Dolibarr before 24.0.0 contains a sensitive data exposure vulnerability in the Members REST API that allows authenticated attackers with member-read rights to retrieve bcrypt password verifiers by querying member endpoints. Attackers can call the individual member or member list endpoints to obtain crypted password verifier fields that are not filtered by the base API serializer or the Members API class, potentially enabling offline password cracking attacks.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.5",
  "pubDate": "2026-08-24T20:17:13.420Z",
  "pubdate": "2026-08-24T20:17:13.420Z",
  "executiveSummary": "Dolibarr before 24.0.0 suffers from a sensitive data exposure vulnerability located within its Members REST API. The flaw permits authenticated attackers possessing member-read rights to harvest bcrypt password verifiers by directly querying specific member endpoints. This improper information disclosure affects Dolibarr versions prior to 24.0.0 and carries significant risk implications for organizational security, as credential hashes can be exported in bulk or individually via programmatic requests.\nThe primary impact of this vulnerability is the unauthorized extraction of cryptographic password material. While the passwords are not stored in plaintext, the exposure of bcrypt password verifiers enables malicious actors to perform offline brute-force and dictionary cracking attacks against the harvested hashes. Successful exploitation requires authenticated access with member-read privileges, meaning an attacker must first obtain a valid user session or API token with specific access rights before interacting with the vulnerable REST API interface.",
  "technicalDetails": "The vulnerability stems from inadequate data filtering within the Members API class and the base API serializer of Dolibarr prior to version 24.0.0. When REST API clients query the individual member endpoint or the member list endpoint, the underlying serialization logic fails to strip sensitive user attributes, specifically the crypted password verifier fields associated with member accounts. Consequently, these backend cryptographic parameters are unnecessarily included in the JSON responses returned to the API consumer.\nThe exploitation lifecycle follows a distinct attack flow. First, an authenticated attacker acquires a valid session or API credential possessing member-read privileges. Second, the attacker formulates an HTTP GET request targeting the vulnerable REST API endpoints, such as the general member listing route or a specific member identifier route. Third, the Dolibarr application processes the request, queries the database, and serializes the member objects without sanitizing the sensitive authentication attributes. Fourth, the API returns the serialized payload containing the raw bcrypt password verifiers to the client. Finally, the attacker extracts the cryptographic verifiers from the response body and transports them to an offline computing environment to execute password cracking routines.\nThe affected component is the Members REST API endpoint handler and associated serialization classes within Dolibarr versions prior to 24.0.0. The vulnerability requires network access to the target instance, active authentication, and specific authorization in the form of member-read rights. The payload behavior involves standard REST API interaction returning over-exposed data fields, resulting in severe post-exploitation impact due to potential credential compromise across the system."
}