CVE-2026-71509 in Dolibarr
Summary
by MITRE • 08/24/2026
Dolibarr before 24.0.0 contains an improper authorization vulnerability in the expense report REST API update endpoint that allows authenticated attackers with expense-creation rights to bypass the approval workflow by directly setting approval status and approver identity fields. Attackers can manipulate workflow state fields through the REST API to advance expense reports to approved or closed status without possessing the dedicated approval right, while also creating forensic inconsistencies in audit records due to missing approval timestamps.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 08/24/2026
The vulnerability identified in Dolibarr versions prior to 24.0.0 represents a critical failure in server-side access control mechanisms within its REST API implementation. Specifically, this flaw resides in the update endpoint for expense reports, where the application fails to enforce proper authorization checks on sensitive workflow state fields. While the system correctly restricts who can create new expense reports based on user roles and permissions, it neglects to validate whether a requesting authenticated user possesses the specific privileges required to modify approval-related attributes. This discrepancy creates an insecure direct object reference scenario where users with limited rights, such as those granted only expense-creation capabilities, are able to interact directly with internal state management functions that should be reserved for designated approvers or administrators.
From a technical perspective, the core issue is an improper authorization flaw wherein the application logic does not adequately distinguish between different types of data modifications during an update operation. When an authenticated user submits a request to modify an expense report via the REST API, they can include fields related to approval status and approver identity in their payload. The backend processes these inputs without verifying if the current session holder has the requisite role or permission set to perform such actions. Consequently, attackers can programmatically manipulate workflow state variables, effectively overriding the intended business logic that requires a separate, distinct action by an authorized individual to approve expenses. This allows for the direct setting of approval status and approver identity fields, bypassing any intermediate steps or validations designed to ensure legitimate oversight.
The operational impact of this vulnerability is significant, as it undermines the integrity of financial controls and audit trails within the organization. By allowing users to advance expense reports to approved or closed statuses without proper authorization, the system permits unauthorized reimbursement approvals that may not have been reviewed for accuracy or compliance with company policies. This bypasses essential internal controls designed to prevent fraud and ensure fiscal responsibility. Furthermore, because these changes are made through an API endpoint rather than the standard user interface workflow, critical metadata such as approval timestamps is often omitted or incorrectly recorded. This leads to forensic inconsistencies in audit records, making it difficult for security teams and auditors to trace who actually approved a report and when, thereby complicating incident response and compliance verification efforts.
This vulnerability aligns with CWE-269, which classifies Improper Privilege Management, as the application fails to enforce proper authorization checks on critical functions. Additionally, from an offensive cybersecurity perspective, this behavior is indicative of ATT&CK technique T1078, Valid Accounts, where attackers leverage existing credentials but exploit misconfigured permissions to escalate their effective privileges within the application context. The ability to manipulate workflow states remotely via API also touches upon aspects of data manipulation that could facilitate further malicious activities if integrated with other system components.
To mitigate this risk, organizations running Dolibarr versions prior to 24.0.0 should prioritize upgrading to version 24.0.0 or later where these authorization checks have been corrected. In the interim, administrators can implement compensating controls by restricting access to the specific REST API endpoints involved in expense report updates through network-level firewalls or web application firewall rules that limit exposure to trusted internal networks only. It is also advisable to review existing audit logs for any anomalous patterns of approval status changes occurring outside normal business hours or from unexpected user accounts, as these may indicate exploitation attempts. Ensuring that API endpoints enforce strict role-based access control checks on all mutable fields, particularly those affecting workflow state and security-sensitive metadata like timestamps, is essential for maintaining the integrity of financial workflows.