CVE-2026-125754

CVSS 7.1 (high) · published 2026-11-10

Dolibarr 20.0.0 through 23.0.4 and 24.x before 24.0.2 contains an insecure direct object reference vulnerability in api_expensereports.class.php payment endpoints that lets authenticated users access other users' expense report payments. Attackers with only expense report read and create rights can call getAllPayments, getPayments, addPayment, or updatePayment to read, create, or modify payments, falsifying reimbursement state.

Weakness: CWE-639

Source: NVD CVE-2026-125754

References

• https://github.com/Dolibarr/dolibarr/blob/24.0.1/htdocs/expensereport/class/api_expensereports.class.php#L959-L968
• https://github.com/Dolibarr/dolibarr/commit/322026099df5cffcca2fd45dd76193fca601cfd9
• https://github.com/Dolibarr/dolibarr/commit/afc12abbd24a1560aee04356e840d5819a1169fd
• https://github.com/Dolibarr/dolibarr/issues/40687
• https://github.com/Dolibarr/dolibarr/pull/40473
• https://www.vulncheck.com/advisories/dolibarr-20.0.0-through-23.0.4-and-24-x-before-24.0.2-idor-via-expensereport-payment-api
• https://github.com/Dolibarr/dolibarr/issues/40687

Check your software

Connect an AI agent to the FixLane MCP server or ask the Telegram bot to check what you have installed against incidents with a verified fixed version.