Dolibarr before version 24.0.0 contains an improper authorization flaw in the Members REST API that permits any user with member‑creation rights to reset the password of any account, including the system administrator. By supplying an arbitrary user identifier and a new password in the request body, the attacker can overwrite credentials, immediately lock out the legitimate account holder, and gain full control of the target system. The vulnerability is classified as Missing Authorization (CWE‑862) and inappropriate enforcement of permission checks (CWE‑915).

Vulnerable product: Dolibarr from all releases prior to 24.0.0. The flaw appears in the Members REST API endpoint responsible for password resets. No specific sub‑version information beyond the pre‑24.0.0 cutoff is provided.

The CVSS base score of 8.6 indicates a high‑severity impact, and the vulnerability is not yet listed in the CISA KEV catalog. Exploitation requires only the ability to create members via the API, a privilege typically granted to regular users, meaning that a threat actor who gains or already possesses such rights can reset the password of any user, including the administrator, without further authentication. This makes the attack probable in environments where member‑creation rights are overly permissive, such as open community accounts or poorly audited API access. The lack of an EPSS rating suggests the exploitation probability is currently unknown, but the high CVSS indicates that once exploited, the attacker can fully compromise the system.