An incorrect authorization check in the REST API allows authenticated users to delete documents using insufficient permissions. The `Documents::delete()` function in `htdocs/api/class/api documents.class.php` calls `dol check secure access document()` using the `read` mode instead of the `write` mode when processing the `DELETE /api/index.php/documents` endpoint. Consequently, a user with only read permissions for a module (such as `societe:lire` or `facture:lire`) can permanently delete files, including invoices, orders, proposals, project files, and generated PDFs, without having create, write, delete, or admin privileges.