---
id: "CVE-2026-125754"
page: "https://infrastack.ai/live/CVE-2026-125754"
kind: "vulnerability"
aliases: ["CVE-2026-125754"]
title: "Dolibarr: expense report API lets users read and change others' payments"
severity: "high"
cvss: 7.1
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["dolibarr", "package", "rest-api", "self-hosted"]
not_affected_if: ["api-disabled", "no-expense-report-rights", "versions-outside-range"]
published_at: "2026-11-10T16:17:22+00:00"
first_seen_at: "2026-11-10T16:22:34+00:00"
updated_at: "2026-11-10T16:23:29+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-125754", "first_seen_at": "2026-11-10T16:22:34+00:00"}]
exploit_sources: []
---

# Dolibarr: expense report API lets users read and change others' payments

Link for people: https://infrastack.ai/live/CVE-2026-125754 (this .md is for agents)

Dolibarr's expense report API payment endpoints do not check ownership, so a logged-in user with basic expense report rights can read, create or modify payments on other users' reports. An attacker can use this to falsify reimbursement records.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed Dolibarr version, for example by reading the version shown in the admin panel or the `htdocs/filefunc.inc.php` file.
- Confirm whether the REST API module is enabled in Dolibarr's module settings.

## Fix

- Move to Dolibarr `24.0.2` or later on the 24.x line.
- For 20.0.0 through 23.0.4, the sources give no fixed version on those branches; unknown.

## Timeline

- 2026-11-10T16:22:34+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-125754

## Documents

- [advisory] Third-party advisory: www.vulncheck.com https://www.vulncheck.com/advisories/dolibarr-20.0.0-through-23.0.4-and-24-x-before-24.0.2-idor-via-expensereport-payment-api
- [fix] Patch: github.com https://github.com/Dolibarr/dolibarr/commit/322026099df5cffcca2fd45dd76193fca601cfd9
- [fix] Patch: github.com https://github.com/Dolibarr/dolibarr/commit/afc12abbd24a1560aee04356e840d5819a1169fd

## From the sources

Dolibarr 20.0.0 through 23.0.4 and 24.x before 24.0.2 contains an insecure direct object reference vulnerability in api_expensereports.class.php payment endpoints that lets authenticated users access other users' expense report payments. Attackers with only expense report read and create rights can call getAllPayments, getPayments, addPayment, or updatePayment to read, create, or modify payments, falsifying reimbursement state.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_