What’s Vulnerable › Vulnerabilities

CVE-2026-71505: Dolibarr < 24.0.0 REST API Broken Object-Level Authorization via Third-Party Write Route

• Severity: high (CVSS 7.1 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.4% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-08-24 · updated 2026-10-12
• Weakness: CWE-639

Description

Dolibarr before 24.0.0 contains a broken object-level authorization vulnerability in the REST API third-party site account write routes that allows authenticated attackers with third-party creation rights to overwrite the WebPortal password of any company by bypassing per-object access checks that are only enforced on read routes. Attackers can replace the victim company's WebPortal password through the write endpoint, authenticate as that company to access its invoice data, and also obtain the victim's previous password verifier from the API response.

Affected products

• dolibarr: before 24.0.0 — fixed in 24.0.0

How to fix

Upgrade to a fixed version: dolibarr 24.0.0. Check the vendor advisory for mitigations.

References

• https://codeant.ai/security-research/cve-2026-71505-dolibarr-bola-enables-portal-account-takeover
• https://github.com/Dolibarr/dolibarr/commit/4cf305ebb958eeffa921aad7c94de179b764f7e7
• https://github.com/Dolibarr/dolibarr/releases/tag/24.0.0
• https://www.vulncheck.com/advisories/dolibarr-rest-api-broken-object-level-authorization-via-third-party-write-route

Get alerted when CVE-2026-71505 or the next vulnerability affects your stack