CVE-2026-71511

MEDIUM 6.5

Dolibarr < 24.0.0 Members REST API Sensitive Data Exposure via Member Endpoints

CVSS Score

6.5

EPSS Score

0.0%

EPSS Percentile

0th

Dolibarr before 24.0.0 contains a sensitive data exposure vulnerability in the Members REST API that allows authenticated attackers with member-read rights to retrieve bcrypt password verifiers by querying member endpoints. Attackers can call the individual member or member list endpoints to obtain crypted password verifier fields that are not filtered by the base API serializer or the Members API class, potentially enabling offline password cracking attacks.

CWE	CWE-522
Vendor	dolibarr
Product	dolibarr
Published	Aug 24, 2026

Stay Ahead of the Next One

Get instant alerts for dolibarr dolibarr

Be the first to know when new medium vulnerabilities affecting dolibarr dolibarr are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Affected Versions

Dolibarr / dolibarr

0 < 24.0.0

References

NVD ↗ CVE.org ↗ EPSS Data ↗

codeant.ai: https://codeant.ai/security-research/cve-2026-71511-dolibarr-members-api-exposes-password-hashes github.com: https://github.com/Dolibarr/dolibarr/releases/tag/24.0.0 github.com: https://github.com/Dolibarr/dolibarr/commit/b1691356eb96d962833e5c7325c9e58e6823c78d vulncheck.com: https://www.vulncheck.com/advisories/dolibarr-members-rest-api-sensitive-data-exposure-via-member-endpoints

Credits

CodeAnt AI Security Research VulnCheck