CVE-2026-71509 Dolibarr < 24.0.0 Expense Report REST API Improper Authorization via Update Endpoint
Authenticated attackers with expense-creation rights can bypass approval workflows and modify expense report status via the REST API.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-71509?
CVE-2026-71509 is a high-severity missing authorization vulnerability in dolibarr, published on 24 Aug 2026. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
Dolibarr before 24.0.0 contains an improper authorization vulnerability in the expense report REST API update endpoint that allows authenticated attackers with expense-creation rights to bypass the approval workflow by directly setting approval status and approver identity fields. Attackers can manipulate workflow state fields through the REST API to advance expense reports to approved or closed status without possessing the dedicated approval right, while also creating forensic inconsistencies in audit records due to missing approval timestamps.
Weakness: CWE-862
Which versions are affected by CVE-2026-71509?
How do I fix CVE-2026-71509?
No fix has been published for CVE-2026-71509 yet. Limit exposure of the affected software until one is available.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2026-71509 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-71509 exists.
Sources
Also known as GHSA-fp99-c8qh-4mjj.