Insecure Direct Object Reference in Dolibarr Payment API

CVE-2026-125754

What is CVE-2026-125754?

Dolibarr versions 20.0.0 through 23.0.4 and 24.x prior to 24.0.2 contain a vulnerability in the payment endpoints of the api_expensereports.class.php file. This issue allows authenticated users, particularly those with only read and create rights on expense reports, to exploit endpoints such as getAllPayments, getPayments, addPayment, and updatePayment. Consequently, they can access, create, or modify other users' expense report payments, which may lead to falsified reimbursement statuses and unauthorized access to sensitive financial data.

References