@codeant-security

Amartya Jha

@codeant-securityJoined August 2026

Sharing thoughts on code, code security and more. @CodeAnt

Website

About

Nothing here yet.

Available for

Nothing here yet.

Amartya Jha's blogs

Security Research — CodeAnt AIsecurity-research.hashnode.dev10 posts

Articles Comments

Recently published

AJAmartya Jhasecurity-research.hashnode.dev2d ago · 5 min read

CVE-2026-71511 · Read a member's card, receive their password hash

CVSS 6.5 · Sensitive data exposure (CWE-200) · Fixed in Dolibarr 24.0.0 Every reply is supposed to pass a redactor that blacks out secrets. The Users redactor blacks out the password. The Members reda

AJAmartya Jhasecurity-research.hashnode.dev2d ago · 6 min read

CVE-2026-71510 · Ask enough yes/no questions and you know everyone's salary

CVSS 6.5 · Authorization oracle → blind disclosure (CWE-863 / CWE-200) · Fixed in Dolibarr 24.0.0 You can't see the salary column, but the search box will happily answer “is this person's salary above

AJAmartya Jhasecurity-research.hashnode.dev2d ago · 5 min read

CVE-2026-71509 · Approve your own expenses — and your whole team's

CVSS 6.5 · Approval / access-control bypass (CWE-862) · Fixed in Dolibarr 24.0.0 The big “Approve” button correctly needs a manager. But the plain “edit this report” form lets you type approved and na

AJAmartya Jhasecurity-research.hashnode.dev2d ago · 5 min read

CVE-2026-71508 · Set your own salary — and the receipt hides it

CVSS 6.5 · Mass assignment on payroll fields (CWE-915) · Fixed in Dolibarr 24.0.0 The form that updates your profile refuses to let you change your job title, but leaves “salary” wide open, then shows

AJAmartya Jhasecurity-research.hashnode.dev2d ago · 6 min read

CVE-2026-71507 · Change one number, and the payroll run pays you

CVSS 6.5 · Object-level auth bypass → SEPA payment redirection (CWE-639) · Fixed in Dolibarr 24.0.0 You can't see a supplier's account, but you can quietly edit the bank number the company will pay. W

Amartya Jha

About

Available for

Amartya Jha's blogs

Recently published

CVE-2026-71511 · Read a member's card, receive their password hash

CVE-2026-71510 · Ask enough yes/no questions and you know everyone's salary

CVE-2026-71509 · Approve your own expenses — and your whole team's

CVE-2026-71508 · Set your own salary — and the receipt hides it

CVE-2026-71507 · Change one number, and the payroll run pays you

Search Hashnode

Amartya Jha

About

Available for

Amartya Jha's blogs

Recently published

CVE-2026-71511 · Read a member's card, receive their password hash

CVE-2026-71510 · Ask enough yes/no questions and you know everyone's salary

CVE-2026-71509 · Approve your own expenses — and your whole team's

CVE-2026-71508 · Set your own salary — and the receipt hides it

CVE-2026-71507 · Change one number, and the payroll run pays you