Vulnerability Description
Dolibarr before 24.0.0 contains an improper authorization vulnerability in the payments REST API delete endpoint that allows authenticated attackers with invoice-deletion rights to permanently delete any payment record by bypassing the intended payment-issuance rights check. Attackers can exploit this misconfigured permission check to zero paid amounts on invoices and remove entries from accounting exports, causing financial data integrity loss.
CVSS Score
HIGH
Related Weaknesses (CWE)
References
- https://codeant.ai/security-research/cve-2026-71506-dolibarr-payment-deletion-vi
- https://github.com/Dolibarr/dolibarr/commit/e01a12ffea4675f5bcc1c886f06ec6a29d5e
- https://github.com/Dolibarr/dolibarr/releases/tag/24.0.0
- https://www.vulncheck.com/advisories/dolibarr-payments-rest-api-improper-authori
FAQ
What is CVE-2026-71506?
CVE-2026-71506 is a vulnerability with a CVSS score of 8.1 (HIGH). Dolibarr before 24.0.0 contains an improper authorization vulnerability in the payments REST API delete endpoint that allows authenticated attackers with invoice-deletion rights to permanently delete ...
How severe is CVE-2026-71506?
CVE-2026-71506 has been rated HIGH with a CVSS base score of 8.1/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2026-71506?
Check the references section above for vendor advisories and patch information. Review vendor security bulletins for remediation guidance.