CVE-2026-71509 · Approve your own expenses — and your whole team's
CVSS 6.5 · Approval / access-control bypass (CWE-862) · Fixed in Dolibarr 24.0.0
The big “Approve” button correctly needs a manager. But the plain “edit this report” form lets you type approved and na
security-research.hashnode.dev5 min read