CVE-2026-71507

Name of the Vulnerable Software and Affected Versions Dolibarr versions prior to 24.0.0

Description A broken object-level authorization issue exists in the REST API company bank account write routes. This allows authenticated attackers with third-party creation rights to create, replace, or delete bank account details of any company without needing read access to that company. By injecting attacker-controlled IBANs as creditor accounts, an attacker can manipulate regenerated SEPA (Single Euro Payments Area) credit-transfer files to redirect outgoing payments to accounts under their control.

Recommendations Update to version 24.0.0 or later.