CVE-2026-71506: Dolibarr < 24.0.0 Payments REST API Improper Authorization via Delete Endpoint
Dolibarr before 24.0.0 contains an improper authorization vulnerability in the payments REST API delete endpoint that allows authenticated attackers with invoice-deletion rights to permanently delete any payment record by bypassing the intended payment-issuance rights check. Attackers can exploit this misconfigured permission check to zero paid amounts on invoices and remove entries from accounting exports, causing financial data integrity loss.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Dolibarrto a version that resolves this vulnerability.Fixed in 24.0.0 - Compensating control
Restrict access to the Dolibarr payments REST API delete endpoint to only users who are intended to have payment-deletion permissions (e.g., enforce least privilege at the application role level and/or at the network/ACL level).
Event History
Frequently Asked Questions
Which users can exploit this issue?
An attacker must be authenticated and have invoice-deletion rights. They do not need the intended payment-issuance rights because the affected delete endpoint checks the wrong permission.
What records can be affected?
A qualifying user can permanently delete any payment record through the payments REST API delete endpoint. This can zero paid amounts on invoices and remove payment entries from accounting exports.
Which versions require remediation?
Dolibarr versions before 24.0.0 are affected. Upgrading to 24.0.0 or later addresses the vulnerable authorization check.
What can be done if an upgrade is not immediately possible?
Restrict invoice-deletion rights to only trusted users, since those rights enable exploitation of the affected endpoint. Review payment deletions and related invoice paid amounts and accounting exports for unexpected changes.