Dolibarr versions prior to 24.0.0 contain a SQL injection flaw in the users REST API. When an authenticated user with read permissions supplies an unsanitized filter parameter, the value is injected directly into a SQL WHERE clause without column restrictions. This flaw allows an attacker to perform binary searches on numeric fields and LIKE prefix iterations on string fields, recovering sensitive information such as salary figures and password verifier hashes that are normally omitted from the API response. Raw database error messages returned by the same endpoint further enable attackers to enumerate existing column names.

The affected products include Dolibarr ERP/CRM from the vendor Dolibarr: Dolibarr. All installations running a version earlier than 24.0.0 are vulnerable. Detailed fix references point to the 24.0.0 release and the corresponding commit, indicating that newer releases contain the patch.

The CVSS score of 7.1 classifies the vulnerability as high severity, and the lack of an EPSS score makes the exact exploit probability uncertain. The flaw requires authentication with user‑read rights, meaning that protected accounts can be abused to extract confidential data. The vulnerability is not listed in the CISA KEV catalog, but its impact on data confidentiality and the relatively straightforward exploitation steps make it a significant risk for organizations using the affected Dolibarr version.