CVE-2026-125754

HighCVSS 7.1/10Last modified Nov 10, 2026

Description

Dolibarr 20.0.0 through 23.0.4 and 24.x before 24.0.2 contains an insecure direct object reference vulnerability in api_expensereports.class.php payment endpoints that lets authenticated users access other users' expense report payments. Attackers with only expense report read and create rights can call getAllPayments, getPayments, addPayment, or updatePayment to read, create, or modify payments, falsifying reimbursement state.

Metrics

CVSS 3.1 7.1/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N

Weakness enumeration

CWE-639

Affected software

No affected versions have been published.

Timeline

Published: Nov 10, 2026
Last modified: Nov 10, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-1257556.5Nodemailer 3.0.0 before 10.4.1 contains an address parsing flaw in addressparser that truncates domains at folding whitespace or comments be CVE-2026-1257565.9postal-mime before 4.2.1 contains a parser differential vulnerability in its address parser that truncates the domain at folding whitespace CVE-2026-1257579.1mailcow: dockerized before 2026-11 contains a server-side template injection vulnerability that allows domain administrators to execute comm CVE-2026-1257587.4Aptabase before commit 61d4c01 contains an authentication bypass vulnerability that allows unauthenticated attackers to forge sign-in links CVE-2026-1257597.5Nango before 0.71.3 contains an sql injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL by supplying a cr CVE-2026-125767.5DVP80ES3 with Improper Enforcement of Message Integrity During Transmission in a Communication Channel vulnerability.CVE-2026-1257616.5Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in YITH YITH WooCommerce Ajax Search yith CVE-2026-1257626.5Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in LeapWorx Premium Addons for Elementor CVE-2026-1257635.3Missing Authorization vulnerability in Brainstorm Force SureForms sureforms allows Exploiting Incorrectly Configured Access Control Security CVE-2026-1257665.3Insertion of Sensitive Information Into Sent Data vulnerability in WPZOOM WPZOOM Social Feed Widget & Block instagram-widget-by-wpzoom allow CVE-2026-1257675.3Insertion of Sensitive Information Into Sent Data vulnerability in NerdPress Hubbub Lite social-pug allows Retrieve Embedded Sensitive Data.CVE-2026-125778.7DVP80ES3 with Improperly Implemented Security Check for Standard vulnerability.