CVE-2026-71510 · Ask enough yes/no questions and you know everyone's salary
CVSS 6.5 · Authorization oracle → blind disclosure (CWE-863 / CWE-200) · Fixed in Dolibarr 24.0.0
You can't see the salary column, but the search box will happily answer “is this person's salary above
security-research.hashnode.dev6 min read