A vulnerability in the Dolibarr members API allows authenticated attackers to perform unauthorized data modifications, posing a significant risk to system integrity.

This vulnerability involves missing authorization (CWE-862) and improper control of dynamically determined object attributes (CWE-915). An authenticated attacker can exploit the members API to manipulate sensitive object fields, bypassing intended security restrictions.

The exploitation of this flaw allows attackers with valid user credentials to modify system data, which could lead to unauthorized privilege escalation or the corruption of business records. Given the high CVSS score of 8.1, this represents a significant risk to the confidentiality and integrity of the application. Failure to remediate could result in unauthorized administrative actions or loss of data control.

Immediate Action: Upgrade to Dolibarr version 24.0.0 or later to apply the necessary authorization checks and input validation.

Proactive Monitoring: Review application access logs for unusual API activity, specifically targeting the members module for unexpected POST or PUT requests.

Compensating Controls: Deploy a Web Application Firewall (WAF) to inspect API traffic for signs of mass assignment or unauthorized parameter manipulation.

Public Exploit Available: No

Organizations utilizing Dolibarr should prioritize the update to version 24.0.0 immediately. The ability to manipulate system objects via the API is a critical security gap that requires prompt patching to prevent potential data integrity compromises.