Vulnerability · Published Aug 24, 2026 · Assigned by VulnCheck

CVE-2026-71505Dolibarr < 24.0.0 REST API Broken Object-Level Authorization via Third-Party Write Route

High 7.1

In plain English

A high-severity authorization bypass via user-controlled key in dolibarr from Dolibarr. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 35% of all known vulnerabilities).

Severity (CVSS 3.1)7.1High

Exploit odds (30 days)0.4%top 64.5% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

Dolibarr before 24.0.0 contains a broken object-level authorization vulnerability in the REST API third-party site account write routes that allows authenticated attackers with third-party creation rights to overwrite the WebPortal password of any company by bypassing per-object access checks that are only enforced on read routes. Attackers can replace the victim company's WebPortal password through the write endpoint, authenticate as that company to access its invoice data, and also obtain the victim's previous password verifier from the API response.

Affected products (as reported)

Vendor	Product	Versions
Dolibarr	dolibarr	0 – before 24.0.0

Weakness: CWE-639 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N

References

CodeAnt AI Blog technical-description, exploit
Dolibarr 24.0.0 Release Notes release-notes
Patch Commit patch
https://www.vulncheck.com/advisories/dolibarr-rest-api-broken-object-level-authorization-via-third-party-write-route third-party-advisory