CyberRota Analysis
AI-GeneratedAn improper authorization vulnerability in the Members REST API of Dolibarr versions prior to 24.0.0 allows attackers with member-creation rights to reset any user account's password, including that of the system administrator, without proper permission checks. This can lead to unauthorized access and account lockout for legitimate users. Organizations using Dolibarr should prioritize patching this vulnerability to protect against potential account takeovers and administrative access breaches.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Dolibarr before 24.0.0 contains an improper authorization vulnerability in the Members REST API that allows attackers with only member-creation rights to reset the password of any user account, including the system administrator, without verifying password-change permissions. Attackers can supply an arbitrary user account identifier and new password in the request body to overwrite credentials and immediately lock out the legitimate account holder.