Vulnerability · Published Aug 24, 2026 · Assigned by VulnCheck

CVE-2026-71506Dolibarr < 24.0.0 Payments REST API Improper Authorization via Delete Endpoint

High 8.1

In plain English

A high-severity incorrect authorization in dolibarr from Dolibarr. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 45% of all known vulnerabilities).

Severity (CVSS 3.1)8.1High

Exploit odds (30 days)0.5%top 54.6% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

Dolibarr before 24.0.0 contains an improper authorization vulnerability in the payments REST API delete endpoint that allows authenticated attackers with invoice-deletion rights to permanently delete any payment record by bypassing the intended payment-issuance rights check. Attackers can exploit this misconfigured permission check to zero paid amounts on invoices and remove entries from accounting exports, causing financial data integrity loss.

Affected products (as reported)

Vendor	Product	Versions
Dolibarr	dolibarr	0 – before 24.0.0

Weakness: CWE-863 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H

References

CodeAnt AI Blog technical-description, exploit
Dolibarr 24.0.0 Release Notes release-notes
Patch Commit patch
https://www.vulncheck.com/advisories/dolibarr-payments-rest-api-improper-authorization-via-delete-endpoint third-party-advisory