What’s Vulnerable › Vulnerabilities

CVE-2026-71510: Dolibarr < 24.0.0 Users REST API SQL Injection via filter parameter

• Severity: medium (CVSS 6.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.4% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-08-24 · updated 2026-10-12
• Weakness: CWE-863

Description

Dolibarr before 24.0.0 contains a SQL injection vulnerability in the users REST API that allows authenticated attackers with user-read rights to extract sensitive data by splicing unsanitized filter parameters into SQL WHERE clauses without column restrictions. Attackers can perform binary search on numeric fields and LIKE prefix iteration on string fields to recover salary figures and password verifiers omitted from normal API responses, while raw database error messages in the same endpoint enable column name enumeration.

Affected products

• dolibarr: before 24.0.0 — fixed in 24.0.0

How to fix

Upgrade to a fixed version: dolibarr 24.0.0. Check the vendor advisory for mitigations.

References

• https://codeant.ai/security-research/cve-2026-71510-blind-column-extraction-via-sqlfilters
• https://github.com/Dolibarr/dolibarr/commit/12687f83705c2a1e46aaf6f8d1ac7347bee4710c
• https://github.com/Dolibarr/dolibarr/releases/tag/24.0.0
• https://www.vulncheck.com/advisories/dolibarr-users-rest-api-sql-injection-via-filter-parameter

Get alerted when CVE-2026-71510 or the next vulnerability affects your stack