CVE-2026-71504 — Dolibarr < 24.0.0 Members REST API Improper Authorization via Password Reset
Dolibarr before 24.0.0 contains an improper authorization vulnerability in the Members REST API that allows attackers with only member-creation rights to reset the password of a…
Published: 2026-08-24 · CVSS: 8.6 · CVSS 4.0
Dolibarr before 24.0.0 contains an improper authorization vulnerability in the Members REST API that allows attackers with only member-creation rights to reset the password of any user account, including the system administrator, without verifying password-change permissions. Attackers can supply an arbitrary user account identifier and new password in the request body to overwrite credentials and immediately lock out the legitimate account holder.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7