CVE-2026-71510
Dolibarr < 24.0.0 Users REST API SQL Injection via filter parameter
CVSS Score
6.5
EPSS Score
0.0%
EPSS Percentile
0th
Dolibarr before 24.0.0 contains a SQL injection vulnerability in the users REST API that allows authenticated attackers with user-read rights to extract sensitive data by splicing unsanitized filter parameters into SQL WHERE clauses without column restrictions. Attackers can perform binary search on numeric fields and LIKE prefix iteration on string fields to recover salary figures and password verifiers omitted from normal API responses, while raw database error messages in the same endpoint enable column name enumeration.
| CWE | CWE-863 |
| Vendor | dolibarr |
| Product | dolibarr |
| Published | Aug 24, 2026 |
| Last Updated | Aug 24, 2026 |
Stay Ahead of the Next One
Get instant alerts for dolibarr dolibarr
Be the first to know when new medium vulnerabilities affecting dolibarr dolibarr are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N Attack Vector
Network
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
None
Availability
None
Affected Versions
Dolibarr / dolibarr
0 < 24.0.0
References
codeant.ai: https://codeant.ai/security-research/cve-2026-71510-blind-column-extraction-via-sqlfilters github.com: https://github.com/Dolibarr/dolibarr/releases/tag/24.0.0 github.com: https://github.com/Dolibarr/dolibarr/commit/12687f83705c2a1e46aaf6f8d1ac7347bee4710c vulncheck.com: https://www.vulncheck.com/advisories/dolibarr-users-rest-api-sql-injection-via-filter-parameter
Credits
CodeAnt AI Security Research VulnCheck