CVE-2026-71507: Dolibarr < 24.0.0 REST API Broken Object-Level Authorization via Bank Account Routes
Dolibarr before 24.0.0 contains a broken object-level authorization vulnerability in the REST API company bank account write routes that allows authenticated attackers with third-party creation rights to create, replace, or delete bank account details of any company without requiring read access to that company. Attackers can inject attacker-controlled IBANs as creditor accounts, which are then written into regenerated SEPA credit-transfer files, redirecting outgoing payments to attacker-controlled accounts.
Affected Software
Event History
Frequently Asked Questions
Which users can exploit this issue?
Any authenticated user with third-party creation rights can exploit the affected REST API bank account write routes. The user does not need read access to the targeted company.
What is the practical impact of a successful exploit?
An attacker can create, replace, or delete bank account details for any company and insert an attacker-controlled IBAN as a creditor account. When SEPA credit-transfer files are regenerated, outgoing payments can be redirected to the attacker-controlled account.
Which versions are affected?
Dolibarr versions before 24.0.0 are affected. Upgrading to 24.0.0 or later addresses the issue.