---
id: CVE-2026-71511
title: >-
  Dolibarr before 24.0.0 contains a sensitive data exposure vulnerability in the
  Members REST API that allows authenticated attackers with member-read rights
  to retrieve bcrypt password verifiers by querying member endpoints
summary: >-
  Dolibarr before 24.0.0 contains a sensitive data exposure vulnerability in the
  Members REST API that allows authenticated attackers with member-read rights
  to retrieve bcrypt password verifiers by querying member endpoints. Attackers
  can…
severity: medium
cvss: 6.5
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N'
cwe:
  - CWE-522
published: '2026-08-24'
updated: '2026-09-08'
sourceUpdated: '2026-09-08T20:23:49.880'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-71511'
references:
  - url: >-
      https://codeant.ai/security-research/cve-2026-71511-dolibarr-members-api-exposes-password-hashes
    label: disclosure@vulncheck.com
  - url: >-
      https://github.com/Dolibarr/dolibarr/commit/b1691356eb96d962833e5c7325c9e58e6823c78d
    label: disclosure@vulncheck.com
  - url: 'https://github.com/Dolibarr/dolibarr/releases/tag/24.0.0'
    label: disclosure@vulncheck.com
  - url: >-
      https://www.vulncheck.com/advisories/dolibarr-members-rest-api-sensitive-data-exposure-via-member-endpoints
    label: disclosure@vulncheck.com
tags:
  - nvd
epss: 0.00415
epssPercentile: 0.33138
ingestedAt: '2026-09-08T21:11:12.285Z'
---

## Overview

Dolibarr before 24.0.0 contains a sensitive data exposure vulnerability in the Members REST API that allows authenticated attackers with member-read rights to retrieve bcrypt password verifiers by querying member endpoints. Attackers can call the individual member or member list endpoints to obtain crypted password verifier fields that are not filtered by the base API serializer or the Members API class, potentially enabling offline password cracking attacks.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.