CVE-2026-81729

Name of the Vulnerable Software and Affected Versions Dolibarr versions prior to 23.0.4

Description An incorrect authorization check in the REST API allows authenticated users to delete documents using insufficient permissions. The Documents::delete() function in htdocs/api/class/api documents.class.php calls dol check secure access document() using the read mode instead of the write mode when processing the DELETE /api/index.php/documents endpoint. Consequently, a user with only read permissions for a module (such as societe:lire or facture:lire) can permanently delete files, including invoices, orders, proposals, project files, and generated PDFs, without having create, write, delete, or admin privileges.

Recommendations Update to version 23.0.4 or later.