Dolibarr releases before version 24.0.0 allow an authenticated user who has member‑read rights to retrieve bcrypt password verifiers via the Members REST API. The API endpoints return the full password verifier fields without filtering, allowing attackers to obtain the stored hash values. If an attacker obtains these hashes, offline brute‑force or dictionary attacks can be used to compromise user accounts. This vulnerability is classified under CWE‑522, indicating that sensitive data is exposed because it is accessible to authenticated users without proper restrictions.

All installations of Dolibarr older than version 24.0.0 are impacted. The vulnerability applies to the Dolibarr member endpoints exposed by the REST API in those releases.

The vulnerability carries a CVSS score of 7.1, indicating a high severity. EPSS data is not available, and the vulnerability is not listed in CISA’s KEV catalog. The attack requires authentication and member‑read privileges, but it can be executed remotely via the web API, giving the attacker a viable path to obtain password hashes for offline cracking.