CyberRota Analysis
AI-GeneratedAn improper authorization vulnerability in the expense report REST API of Dolibarr prior to version 24.0.0 allows authenticated users with expense-creation rights to bypass the approval workflow. This enables attackers to manipulate approval status and approver identity fields, potentially advancing expense reports without proper authorization and creating discrepancies in audit records. Organizations using affected versions of Dolibarr should prioritize remediation to mitigate the risk of unauthorized expense approvals and maintain compliance with audit standards.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Dolibarr before 24.0.0 contains an improper authorization vulnerability in the expense report REST API update endpoint that allows authenticated attackers with expense-creation rights to bypass the approval workflow by directly setting approval status and approver identity fields. Attackers can manipulate workflow state fields through the REST API to advance expense reports to approved or closed status without possessing the dedicated approval right, while also creating forensic inconsistencies in audit records due to missing approval timestamps.