CVE-2026-81729

Received Received - Intake

Incorrect Permission Check Leads to Document Deletion in Dolibarr

Publication date: 2026-08-27

Last updated on: 2026-08-27

Assigner: VulnCheck

Description

Dolibarr before 23.0.4 authorizes REST API document deletion against the wrong permission. Documents::delete() in htdocs/api/class/api_documents.class.php calls dol_check_secure_access_document() with the mode argument 'read' when handling DELETE /api/index.php/documents, while the sibling builddoc() path passes 'write', the correct mode for an operation that modifies stored data. An authenticated API user who holds only a read permission for a document-bearing module, for example societe:lire or facture:lire, and no create, write, delete or admin permission, therefore passes the check and can permanently delete that module's documents: third-party files, invoices, orders, proposals, project files and generated PDFs, with no recovery path. The call site is htdocs/api/class/api_documents.class.php:1276 in 23.0.3 and passes 'write' from 23.0.4 onward.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-27

Last Modified

2026-08-27

Generated

2026-08-28

AI Q&A

2026-08-28

EPSS Evaluated

N/A

NVD

CVE-2026-81729

Affected Vendors & Products

Vendor	Product	Version / Range
dolibarr	dolibarr	to 23.0.4 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-863	The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.

Attack-Flow Graph

Executive Summary

CVE-2026-81729 is an incorrect authorization vulnerability in Dolibarr before version 23.0.4. It allows authenticated users with only read permissions to delete documents via the REST API. The issue occurs because the Documents::delete() function uses 'read' mode instead of 'write' when checking permissions, letting unauthorized users permanently delete files like invoices or PDFs.

Detection Guidance

To detect this vulnerability, check if your Dolibarr instance is running version 23.0.3 or earlier. Inspect the api_documents.class.php file for the Documents::delete() function call to dol_check_secure_access_document() with mode 'read'. If found, the system is vulnerable.

Impact Analysis

An attacker with read-only access could delete critical documents such as invoices, orders, or third-party files. This could lead to data loss, financial discrepancies, or disruption of business operations. The impact is severe as deleted files may not be recoverable.

Compliance Impact

This vulnerability could violate compliance requirements by allowing unauthorized deletion of sensitive data like invoices or customer records. GDPR requires data integrity and protection, while HIPAA mandates secure handling of health-related documents. Unauthorized deletions may lead to non-compliance penalties.

Mitigation Strategies

Upgrade Dolibarr to version 23.0.4 or later to fix the authorization flaw. Ensure only users with write permissions can delete documents. Review API logs for unauthorized document deletions.

Hi! I’m here to help you understand CVE-2026-81729. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70