CyberRota Analysis
AI-GeneratedDolibarr versions prior to 24.0.0 are vulnerable to a broken object-level authorization flaw in the REST API, specifically affecting third-party site account write routes. This vulnerability allows authenticated attackers with rights to create third-party accounts to overwrite any company's WebPortal password, enabling unauthorized access to sensitive invoice data and exposure of the previous password verifier. Organizations using Dolibarr should prioritize patching this vulnerability to prevent potential account takeovers and data breaches.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Dolibarr before 24.0.0 contains a broken object-level authorization vulnerability in the REST API third-party site account write routes that allows authenticated attackers with third-party creation rights to overwrite the WebPortal password of any company by bypassing per-object access checks that are only enforced on read routes. Attackers can replace the victim company's WebPortal password through the write endpoint, authenticate as that company to access its invoice data, and also obtain the victim's previous password verifier from the API response.