Improper Authorization Vulnerability in Dolibarr Expense Report by Dolibarr

CVE-2026-71509

What is CVE-2026-71509?

Dolibarr before version 24.0.0 is susceptible to an improper authorization vulnerability within its expense report REST API update endpoint. This flaw permits authenticated users with rights to create expenses to override the approval workflow. By manipulating certain fields through the API, attackers can unilaterally mark expense reports as approved or closed, effectively bypassing necessary approvals. This not only raises concerns about intentional misuse of expense reports but also leads to inconsistencies in audit trails due to absent approval timestamps, complicating forensic investigations.

References