CVE-2026-71504CWE-862CWE-915broken-access-control

CVE-2026-71504

High · published August 24, 2026

CVSS v3.1
8.1
EPSS
0%
Percentile
38.9
In the wild
Unconfirmed
What it is

Dolibarr before 24.0.0 contains an improper authorization vulnerability in the Members REST API that allows attackers with only member-creation rights to reset the password of any user account, including the system administrator, without verifying password-change permissions. Attackers can supply an arbitrary user account identifier and new password in the request body to overwrite credentials and immediately lock out the legitimate account holder.

The record
Technical detail
CVSS v3.1
8.1 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
CVSS v4.0
8.6 · CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N
EPSS
0.00461 · 38.9th percentile
Weaknesses
CWE-862 · Missing Authorization; CWE-915 · Improperly Controlled Modification of Dynamically-Determined Object Attributes
Published
2026-08-24T23:16Z
References (4)
https://codeant.ai/security-research/cve-2026-71504-mass-assignment-in-members-api-via-pass · [email protected]https://github.com/Dolibarr/dolibarr/commit/fbf476cc5d9a21b16bfa04ab17d4e84eda38d7ce · [email protected]https://github.com/Dolibarr/dolibarr/releases/tag/24.0.0 · [email protected]https://www.vulncheck.com/advisories/dolibarr-members-rest-api-improper-authorization-via-password-reset · [email protected]
EPSS history
Timeline
  • 26 AUG 08:24Z
    EPSS moved — → 0%
    epss
  • 24 AUG 18:57Z
    Dolibarr < 24.0.0 Members REST API Improper Authorization via Password Reset
    cvelistv5