CVE-2026-71505
Received Received - Intake

Broken Object-Level Authorization in Dolibarr REST API

Publication date: 2026-08-24

Last updated on: 2026-08-24

Assigner: VulnCheck

Description
Dolibarr before 24.0.0 contains a broken object-level authorization vulnerability in the REST API third-party site account write routes that allows authenticated attackers with third-party creation rights to overwrite the WebPortal password of any company by bypassing per-object access checks that are only enforced on read routes. Attackers can replace the victim company's WebPortal password through the write endpoint, authenticate as that company to access its invoice data, and also obtain the victim's previous password verifier from the API response.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-24
Last Modified
2026-08-24
Generated
2026-08-24
AI Q&A
2026-08-24
EPSS Evaluated
N/A
NVD
CVE-2026-71505
EUVD
EUVD-2026-65078

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
dolibarr dolibarr to 24.0.0 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-639 The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-71505 is a broken object-level authorization flaw in Dolibarr's REST API affecting versions before 24.0.0. It allows authenticated attackers with third-party creation rights to bypass access controls and overwrite any company's WebPortal password via write endpoints. The issue occurs because read routes enforce per-object checks while write routes do not, enabling unauthorized modifications.

Detection Guidance

To detect this vulnerability, check Dolibarr versions prior to 24.0.0 using commands like 'grep -r "version" /path/to/dolibarr' or check the admin panel for version info. Monitor API logs for unusual third-party write route activities or password reset attempts targeting companies where the user has no ownership.

Impact Analysis

Attackers can replace a company's WebPortal password, gain access to its invoice data, and retrieve previous password verifiers. This enables full account takeover without admin rights or victim interaction. Exploitation requires only the 'create-companies' permission, commonly granted to sales teams.

Mitigation Strategies

Immediately upgrade Dolibarr to version 24.0.0 or later to apply the security patch. Review and restrict 'create-companies' permissions to only necessary users. Audit API access logs for signs of exploitation and revoke unauthorized third-party integrations.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-71505. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart