CVE-2026-71504

HighCVSS 8.1/10Last modified Oct 12, 2026

Description

Dolibarr before 24.0.0 contains an improper authorization vulnerability in the Members REST API that allows attackers with only member-creation rights to reset the password of any user account, including the system administrator, without verifying password-change permissions. Attackers can supply an arbitrary user account identifier and new password in the request body to overwrite credentials and immediately lock out the legitimate account holder.

Metrics

CVSS 3.1 8.1/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

Weakness enumeration

CWE-862 CWE-915

Affected software

No affected versions have been published.

Timeline

Published: Aug 24, 2026
Last modified: Oct 12, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-715057.1Dolibarr before 24.0.0 contains a broken object-level authorization vulnerability in the REST API third-party site account write routes that CVE-2026-715068.1Dolibarr before 24.0.0 contains an improper authorization vulnerability in the payments REST API delete endpoint that allows authenticated a CVE-2026-715076.5Dolibarr before 24.0.0 contains a broken object-level authorization vulnerability in the REST API company bank account write routes that all CVE-2026-715086.5Dolibarr before 24.0.0 contains an improper authorization vulnerability in the user REST API update endpoint that allows attackers with user CVE-2026-715096.5Dolibarr before 24.0.0 contains an improper authorization vulnerability in the expense report REST API update endpoint that allows authentic CVE-2026-71518.8A vulnerability was determined in Tenda HG3 2.0. Impacted is the function formUploadConfig of the file /boaform/formIPv6Routing. This manipu CVE-2026-715106.5Dolibarr before 24.0.0 contains a SQL injection vulnerability in the users REST API that allows authenticated attackers with user-read right CVE-2026-715116.5Dolibarr before 24.0.0 contains a sensitive data exposure vulnerability in the Members REST API that allows authenticated attackers with mem CVE-2026-715138.8NLTK before 3.10.3 contains a remote code execution vulnerability in AllowlistUnpickler that validates only the pickle module string and not CVE-2026-715143.3NLTK 3.9.4 through 3.10.2 contains a path traversal vulnerability in CrubadanCorpusReader. _load_lang_ngrams joins the corpus root with crub CVE-2026-715187.5Typemill before 2.26.0 contains an authorization bypass vulnerability in the media file download route that allows unauthenticated attackers CVE-2026-71529.8A vulnerability was identified in Totolink A8000RU 7.1cu.643_b20200521. The affected element is the function setTelnetCfg of the file /cgi-b