{"id":"CVE-2026-125754","kind":"vulnerability","aliases":["CVE-2026-125754"],"related":[],"title":"Dolibarr: expense report API lets users read and change others' payments","description":"Dolibarr 20.0.0 through 23.0.4 and 24.x before 24.0.2 contains an insecure direct object reference vulnerability in api_expensereports.class.php payment endpoints that lets authenticated users access other users' expense report payments. Attackers with only expense report read and create rights can call getAllPayments, getPayments, addPayment, or updatePayment to read, create, or modify payments, falsifying reimbursement state.","summary":"Dolibarr's expense report API payment endpoints do not check ownership, so a logged-in user with basic expense report rights can read, create or modify payments on other users' reports. An attacker can use this to falsify reimbursement records.","severity":"high","cvss":7.1,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["dolibarr","package","rest-api","self-hosted"],"not_affected_if":["api-disabled","no-expense-report-rights","versions-outside-range"],"how_to_check":"- Check the installed Dolibarr version, for example by reading the version shown in the admin panel or the `htdocs/filefunc.inc.php` file.\n- Confirm whether the REST API module is enabled in Dolibarr's module settings.","fix":"- Move to Dolibarr `24.0.2` or later on the 24.x line.\n- For 20.0.0 through 23.0.4, the sources give no fixed version on those branches; unknown.","status":"open","published_at":"2026-11-10T16:17:22+00:00","first_seen_at":"2026-11-10T16:22:34+00:00","triaged_at":"2026-11-10T16:23:29+00:00","updated_at":"2026-11-10T16:23:29+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-11-10T16:23:29Z","model":"claude-haiku-5-5","output":{"fix":"- Move to Dolibarr `24.0.2` or later on the 24.x line.\n- For 20.0.0 through 23.0.4, the sources give no fixed version on those branches; unknown.","reach":"network","title":"Dolibarr: expense report API lets users read and change others' payments","impact":"medium","summary":"Dolibarr's expense report API payment endpoints do not check ownership, so a logged-in user with basic expense report rights can read, create or modify payments on other users' reports. An attacker can use this to falsify reimbursement records.","audience":"businesses","category":"package","nicknames":[],"who_cares":["dolibarr","self-hosted","rest-api"],"confidence":0.7,"fix_status":"available","needs_auth":"yes","worst_case":"Authenticated users read and alter other users' expense payments","analyst_note":"Confirm the fixed version for the 20.x to 23.x branches from the Patch links or the NVD entry; sources only name 24.0.2.","how_to_check":"- Check the installed Dolibarr version, for example by reading the version shown in the admin panel or the `htdocs/filefunc.inc.php` file.\n- Confirm whether the REST API module is enabled in Dolibarr's module settings.","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["api-disabled","no-expense-report-rights","versions-outside-range"],"who_is_affected":"Companies that run Dolibarr with the REST API enabled and give users expense report read and create rights. Users need an account first, so instances without the API or with tightly restricted accounts are lower risk.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000767,"input_tokens":4660,"output_tokens":601,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-125754':14A,17A '-2026':13A,16A '20.0.0':68C '23.0.4':70C '24':72C '24.0.2':75C 'access':91C 'addpay':110C 'api':4A,22B,30B 'api_expensereports.class.php':84C 'attack':59B,97C 'authent':89C 'basic':44B 'call':107C 'chang':9A 'check':35B 'contain':76C 'creat':50B,104C,115C 'cve':12A,15A 'direct':79C 'dolibarr':1A,18B,26B,67C 'endpoint':32B,86C 'expens':2A,28B,45B,94C,100C 'falsifi':64B,119C 'getallpay':108C 'getpay':109C 'host':25B 'insecur':78C 'let':5A,88C 'log':40B 'logged-in':39B 'modifi':52B,117C 'object':80C 'other':10A 'ownership':36B 'packag':19B 'payment':11A,31B,53B,85C,96C,118C 'read':7A,49B,102C,114C 'record':66B 'refer':81C 'reimburs':65B,120C 'report':3A,29B,46B,57B,95C,101C 'rest':21B 'rest-api':20B 'right':47B,105C 'self':24B 'self-host':23B 'state':121C 'updatepay':112C 'use':61B 'user':6A,42B,56B,90C,93C 'vulner':82C 'x':73C","nicknames":[],"mitigations":[],"who_affected":"Companies that run Dolibarr with the REST API enabled and give users expense report read and create rights. Users need an account first, so instances without the API or with tightly restricted accounts are lower risk.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["dolibarr","high","package","restapi","selfhosted"],"campaign_type":null,"search_a":"'-125754':14A,17A '-2026':13A,16A 'api':4A 'chang':9A 'cve':12A,15A 'dolibarr':1A 'expens':2A 'let':5A 'other':10A 'payment':11A 'read':7A 'report':3A 'user':6A","search_b":"'api':22B,30B 'attack':59B 'basic':44B 'check':35B 'creat':50B 'dolibarr':18B,26B 'endpoint':32B 'expens':28B,45B 'falsifi':64B 'host':25B 'log':40B 'logged-in':39B 'modifi':52B 'ownership':36B 'packag':19B 'payment':31B,53B 'read':49B 'record':66B 'reimburs':65B 'report':29B,46B,57B 'rest':21B 'rest-api':20B 'right':47B 'self':24B 'self-host':23B 'use':61B 'user':42B,56B","search_c":"'20.0.0':68C '23.0.4':70C '24':72C '24.0.2':75C 'access':91C 'addpay':110C 'api_expensereports.class.php':84C 'attack':97C 'authent':89C 'call':107C 'contain':76C 'creat':104C,115C 'direct':79C 'dolibarr':67C 'endpoint':86C 'expens':94C,100C 'falsifi':119C 'getallpay':108C 'getpay':109C 'insecur':78C 'let':88C 'modifi':117C 'object':80C 'payment':85C,96C,118C 'read':102C,114C 'refer':81C 'reimburs':120C 'report':95C,101C 'right':105C 'state':121C 'updatepay':112C 'user':90C,93C 'vulner':82C 'x':73C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-10T16:17:22+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-125754","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-125754","severity":null,"published_at":"2026-11-10T16:17:22+00:00","modified_at":"2026-11-10T16:17:22+00:00","first_seen_at":"2026-11-10T16:22:34+00:00","fetched_at":"2026-11-10T16:22:34+00:00","note":null}],"documents":[{"id":116124,"url":"https://github.com/Dolibarr/dolibarr/commit/322026099df5cffcca2fd45dd76193fca601cfd9","title":"Patch: github.com","kind":"other","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":116125,"url":"https://github.com/Dolibarr/dolibarr/commit/afc12abbd24a1560aee04356e840d5819a1169fd","title":"Patch: github.com","kind":"other","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":116126,"url":"https://www.vulncheck.com/advisories/dolibarr-20.0.0-through-23.0.4-and-24-x-before-24.0.2-idor-via-expensereport-payment-api","title":"Third-party advisory: www.vulncheck.com","kind":"advisory","source":"nvd","publisher":"research","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Third-party advisory: www.vulncheck.com"}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}