Dolibarr: Insecure Direct Object Reference in expense report API (CVE-2026-125754)

Dolibarr versions 20.0.0 through 23.0.4 and 24.x before 24.0.2 contain an insecure direct object reference (IDOR) vulnerability in the api_expensereports.class.php component. Authenticated users with restricted "read" and "create" permissions for expense reports can interact with endpoints, including getAllPayments, getPayments, addPayment, or updatePayment, to access, create, or modify payments belonging to other users. This may result in unauthorized financial data exposure and the falsification of reimbursement states.

Impact

The vulnerability allows authenticated users to read sensitive financial data and manipulate reimbursement records, potentially leading to unauthorized financial gain or corruption of accounting data within the Dolibarr instance.

Recommendation

• Upgrade Dolibarr to version 24.0.2 or later to patch the vulnerable payment endpoints.
• Review application access logs for unexpected access patterns to api_expensereports.class.php associated with non-administrative user accounts.
• Audit expense report payment history for anomalous entries or modifications performed by users outside of the finance department or the specific report owner.