CVE-2026-71505: Dolibarr < 24.0.0 REST API Broken Object-Level Authorization via Third-Party Write Route
Dolibarr before 24.0.0 contains a broken object-level authorization vulnerability in the REST API third-party site account write routes that allows authenticated attackers with third-party creation rights to overwrite the WebPortal password of any company by bypassing per-object access checks that are only enforced on read routes. Attackers can replace the victim company's WebPortal password through the write endpoint, authenticate as that company to access its invoice data, and also obtain the victim's previous password verifier from the API response.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this vulnerability?
An attacker must be authenticated to the Dolibarr REST API and have third-party creation rights. No user interaction is required.
What can an attacker do after exploiting it?
The attacker can overwrite the WebPortal password for any company through the affected write route. They can then authenticate as that company to access its invoice data, and the API response may disclose the company’s previous password verifier.
Which deployments are affected?
Dolibarr versions before 24.0.0 are affected. The issue is in REST API third-party site account write routes, where per-object authorization checks are not enforced as they are on read routes.
What is the available remediation?
Upgrade Dolibarr to version 24.0.0 or later. The provided release and commit references identify the fix.