Vulnerability · Published Aug 24, 2026 · Assigned by VulnCheck

CVE-2026-71509Dolibarr < 24.0.0 Expense Report REST API Improper Authorization via Update Endpoint

Medium 6.5

In plain English

A medium-severity missing authorization in dolibarr from Dolibarr. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 37% of all known vulnerabilities).

Severity (CVSS 3.1)6.5Medium

Exploit odds (30 days)0.4%top 63.2% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

Dolibarr before 24.0.0 contains an improper authorization vulnerability in the expense report REST API update endpoint that allows authenticated attackers with expense-creation rights to bypass the approval workflow by directly setting approval status and approver identity fields. Attackers can manipulate workflow state fields through the REST API to advance expense reports to approved or closed status without possessing the dedicated approval right, while also creating forensic inconsistencies in audit records due to missing approval timestamps.

Affected products (as reported)

Vendor	Product	Versions
Dolibarr	dolibarr	0 – before 24.0.0

Weakness: CWE-862 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

References

CodeAnt AI Blog technical-description, exploit
Dolibarr 24.0.0 Release Notes release-notes
Patch Commit patch
https://www.vulncheck.com/advisories/dolibarr-expense-report-rest-api-improper-authorization-via-update-endpoint third-party-advisory