CVE-2026-125754

Published 10 November 2026 · tracked since 11 November 2026

Description

Dolibarr 20.0.0 through 23.0.4 and 24.x before 24.0.2 contains an insecure direct object reference vulnerability in api_expensereports.class.php payment endpoints that lets authenticated users access other users' expense report payments. Attackers with only expense report read and create rights can

References

• NVD — National Vulnerability Database
• CVE.org record (MITRE)
• CISA Known Exploited Vulnerabilities catalog

Latest tracked vulnerabilities

• CVE-2026-125753 MEDIUM 5.9
• CVE-2026-125747 MEDIUM 5.4
• CVE-2026-124038 LOW 2.3
• CVE-2026-123181 MEDIUM 5.5
• CVE-2026-123179 MEDIUM 5.5
• CVE-2026-121683 CRITICAL 9.4
• CVE-2026-121653 CRITICAL 9.8
• CVE-2026-111256
• CVE-2026-111250
• CVE-2026-111249

→ Open the live CVE board · all tools