CVE-2026-71505

Name of the Vulnerable Software and Affected Versions Dolibarr versions prior to 24.0.0

Description A broken object-level authorization issue exists in the REST API third-party site account write routes. Authenticated attackers with third-party creation rights can bypass per-object access checks, which are only enforced on read routes, to overwrite the WebPortal password of any company. By using the write endpoint, an attacker can replace a victim company's password, authenticate as that company to access invoice data, and retrieve the victim's previous password verifier from the API response.

Recommendations Update to version 24.0.0 or later.