Dolibarr REST API Bank Account Write Bypass

Executive Summary

CVE-2026-71507 is a Broken Object-Level Authorization (BOLA) vulnerability in Dolibarr, an open-source ERP/CRM system. It affects the REST API's company bank account write routes in versions prior to 24.0.0. The flaw allows authenticated attackers with third-party creation rights to create, replace, or delete bank account details of any company without requiring read access to that company. Attackers can inject malicious IBANs as creditor accounts, which are then embedded into regenerated SEPA credit-transfer files, redirecting outgoing payments to attacker-controlled accounts.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, check if your Dolibarr version is prior to 24.0.0. Use API endpoints to test if unauthorized users can modify bank account details. Monitor API logs for suspicious 403 errors or unexpected 200 responses when accessing company bank account routes.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability allows attackers to redirect outgoing payments to their own accounts by modifying bank account details. It enables unauthorized creation, update, or deletion of company bank accounts, potentially leading to financial fraud. Attackers can manipulate SEPA credit-transfer files, making fraud difficult to detect as transaction metadata remains unchanged.

Useful 0 Not Useful 0

Mitigation Strategies

Upgrade Dolibarr to version 24.0.0 or later to apply the security patches. Review API access controls to ensure proper authorization checks are enforced for all company bank account routes. Restrict third-party creation rights to trusted users only.

Useful 0 Not Useful 0