https://db.gcve.eu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Wed, 11 Nov 2026 17:55:45 +0000 https://db.gcve.eu/vuln/fkie_cve-2026-125754 <p>Dolibarr 20.0.0 through 23.0.4 and 24.x before 24.0.2 contains an insecure direct object reference vulnerability in api_expensereports.class.php payment endpoints that lets authenticated users access other users&#39; expense report payments. Attackers with only expense report read and create rights can call getAllPayments, getPayments, addPayment, or updatePayment to read, create, or modify payments, falsifying reimbursement state.</p> <p>Dolibarr 20.0.0 through 23.0.4 and 24.x before 24.0.2 contains an insecure direct object reference vulnerability in api_expensereports.class.php payment endpoints that lets authenticated users access other users&#39; expense report payments. Attackers with only expense report read and create rights can call getAllPayments, getPayments, addPayment, or updatePayment to read, create, or modify payments, falsifying reimbursement state.</p> https://db.gcve.eu/vuln/fkie_cve-2026-125754 https://db.gcve.eu/vuln/ghsa-vj8j-w6v9-74w8 <p>Dolibarr 20.0.0 through 23.0.4 and 24.x before 24.0.2 contains an insecure direct object reference vulnerability in api_expensereports.class.php payment endpoints that lets authenticated users access other users&#39; expense report payments. Attackers with only expense report read and create rights can call getAllPayments, getPayments, addPayment, or updatePayment to read, create, or modify payments, falsifying reimbursement state.</p> <p>Dolibarr 20.0.0 through 23.0.4 and 24.x before 24.0.2 contains an insecure direct object reference vulnerability in api_expensereports.class.php payment endpoints that lets authenticated users access other users&#39; expense report payments. Attackers with only expense report read and create rights can call getAllPayments, getPayments, addPayment, or updatePayment to read, create, or modify payments, falsifying reimbursement state.</p> https://db.gcve.eu/vuln/ghsa-vj8j-w6v9-74w8