{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/tags/financial-system/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:dolibarr:dolibarr:*:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":7.1,"id":"CVE-2026-125754"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["Dolibarr (20.0.0-23.0.4)","Dolibarr (\u003c 24.0.2)"],"_cs_severities":["high"],"_cs_tags":["idor","api-vulnerability","financial-system","vulnerability"],"_cs_type":"advisory","_cs_vendors":["Dolibarr"],"content_html":"\u003cp\u003eDolibarr versions 20.0.0 through 23.0.4 and 24.x before 24.0.2 contain an insecure direct object reference (IDOR) vulnerability in the \u003ccode\u003eapi_expensereports.class.php\u003c/code\u003e component. Authenticated users with restricted \u0026quot;read\u0026quot; and \u0026quot;create\u0026quot; permissions for expense reports can interact with endpoints, including \u003ccode\u003egetAllPayments\u003c/code\u003e, \u003ccode\u003egetPayments\u003c/code\u003e, \u003ccode\u003eaddPayment\u003c/code\u003e, or \u003ccode\u003eupdatePayment\u003c/code\u003e, to access, create, or modify payments belonging to other users. This may result in unauthorized financial data exposure and the falsification of reimbursement states.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eThe vulnerability allows authenticated users to read sensitive financial data and manipulate reimbursement records, potentially leading to unauthorized financial gain or corruption of accounting data within the Dolibarr instance.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpgrade Dolibarr to version 24.0.2 or later to patch the vulnerable payment endpoints.\u003c/li\u003e\n\u003cli\u003eReview application access logs for unexpected access patterns to \u003ccode\u003eapi_expensereports.class.php\u003c/code\u003e associated with non-administrative user accounts.\u003c/li\u003e\n\u003cli\u003eAudit expense report payment history for anomalous entries or modifications performed by users outside of the finance department or the specific report owner.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-11-10T18:27:53Z","date_published":"2026-11-10T18:27:53Z","id":"https://feed.craftedsignal.io/briefs/2026-11-dolibarr-idor/","summary":"An IDOR vulnerability in the Dolibarr expense report API allows authenticated users with minimal privileges to access and manipulate payment records belonging to other users.","title":"Dolibarr: Insecure Direct Object Reference in expense report API (CVE-2026-125754)","url":"https://feed.craftedsignal.io/briefs/2026-11-dolibarr-idor/"}],"language":"en","title":"CraftedSignal Threat Feed - Financial-System","version":"https://jsonfeed.org/version/1.1"}