Attack Chain

1. Attacker obtains valid credentials for a standard user account with at least member-creation privileges in the Dolibarr instance.
2. Attacker performs reconnaissance to identify the endpoint for the Members REST API.
3. Attacker crafts a malicious HTTP POST request targeting the Members API endpoint.
4. Attacker inserts an arbitrary 'user_id' and the desired 'password' into the request body, leveraging mass assignment properties.
5. The Dolibarr server processes the request without enforcing authorization checks for password modification.
6. The backend updates the target user's credentials in the database to the attacker-supplied password.
7. Attacker logs into the target account (including administrative accounts) using the updated credentials.
8. Attacker gains full access to the victim's resources or performs administrative actions.

Impact

Successful exploitation of CVE-2026-71504 results in unauthorized account takeover, including administrative accounts. This leads to complete compromise of the Dolibarr instance, potential exfiltration of sensitive member or organizational data, and denial of service for legitimate users who are locked out of their accounts. The vulnerability affects all Dolibarr installations running versions prior to 24.0.0.

Recommendation

• Update all Dolibarr instances to version 24.0.0 or later immediately.
• Monitor web server logs for suspicious POST requests to the Members REST API, specifically looking for requests that include unexpected password change parameters.
• Audit logs for unauthorized password resets occurring through the API for administrative accounts.
• Restrict access to the Members REST API to only those service accounts or users strictly requiring member-creation privileges.