The Back-Office Break-In: Nine Dolibarr Findings
Nine ways into the software that runs a small business and the one wall that was missing from all of them
Aug 25, 20264 min read3
Command Palette
Search for a command to run...
Series
Dolibarr Security Findings
A Series of our Security Research with Dolibarr
CVE-2026-71503 · One link, opened once, mints a second admin
CVSS 9.3 · Reflected XSS (CWE-79), chained to admin creation · Fixed in Dolibarr 24.0.0 Think of a contractor's badge that, when scanned at reception, silently prints a second master key, and the guar
Aug 25, 20267 min readCVE-2026-71504 · The membership desk that could reset the admin's password
CVSS 8.3 · Mass assignment (CWE-915) · Fixed in Dolibarr 24.0.0 The front desk refuses to change the CEO's password. But the membership clerk's window, which nobody thought to lock will happily do it,
Aug 25, 20266 min readCVE-2026-71505 · The read desk checks your ID. The write desk doesn't.
CVSS 8.1 · Broken object-level authorization (CWE-639) · Fixed in Dolibarr 24.0.0 The clerk who shows you a file first checks it's yours. The clerk who resets the password on that file never checks, s
Aug 25, 20265 min readCVE-2026-71506 · The wrong key on the lock
CVSS 6.5 · Wrong-permission authorization (CWE-863) · Fixed in Dolibarr 24.0.0 The button labelled “delete a draft invoice” is wired to the vault that holds recorded payments. Press it and money that
Aug 25, 20265 min readCVE-2026-71507 · Change one number, and the payroll run pays you
CVSS 6.5 · Object-level auth bypass → SEPA payment redirection (CWE-639) · Fixed in Dolibarr 24.0.0 You can't see a supplier's account, but you can quietly edit the bank number the company will pay. W
Aug 25, 20266 min read