CVE-2026-81729: Dolibarr before 23.0.4 Incorrect Authorization on REST API Document Deletion
Dolibarr before 23.0.4 authorizes REST API document deletion against the wrong permission. Documents::delete() in htdocs/api/class/apidocuments.class.php calls dolchecksecureaccessdocument() with the mode argument 'read' when handling DELETE /api/index.php/documents, while the sibling builddoc() path passes 'write', the correct mode for an operation that modifies stored data. An authenticated API user who holds only a read permission for a document-bearing module, for example societe:lire or facture:lire, and no create, write, delete or admin permission, therefore passes the check and can permanently delete that module's documents: third-party files, invoices, orders, proposals, project files and generated PDFs, with no recovery path. The call site is htdocs/api/class/apidocuments.class.php:1276 in 23.0.3 and passes 'write' from 23.0.4 onward.
Affected Software
Event History
Frequently Asked Questions
Which users can exploit this issue?
An authenticated REST API user with only read permission for a document-bearing module can exploit it. Examples include users with societe:lire or facture:lire who have no create, write, delete, or administrative permission.
Which stored files can be deleted?
Affected users can permanently delete documents belonging to modules they can read, including third-party files, invoices, orders, proposals, project files, and generated PDFs. The described deletion has no recovery path.
How can I determine whether an installation is affected?
Dolibarr versions before 23.0.4 are affected. In 23.0.3, the DELETE documents handler at htdocs/api/class/api_documents.class.php line 1276 passes read to the access check; 23.0.4 and later pass write.
What can be done if upgrading is not immediately possible?
Prevent read-only users from using the REST API endpoint for document deletion by removing their API access or their relevant module read permissions. The issue requires an authenticated API user with document-module read permission.