Improper Authorization Issue in Dolibarr REST API Leading to Document Deletion

CVE-2026-81729

What is CVE-2026-81729?

Dolibarr versions before 23.0.4 contain a critical flaw in the REST API that permits unauthorized users to delete documents without appropriate permissions. The vulnerability arises because the API improperly checks access rights when processing document deletion requests. Specifically, an authenticated user with only read permissions can exploit this flaw to delete important documents including invoices, proposals, and third-party files, leading to data loss without recovery options. The issue has been addressed in version 23.0.4, ensuring secure handling of document deletions.

References