{"id":"CVE-2026-71507","title":"Dolibarr before 24.0.0 contains a broken object-level authorization vulnerability in the REST API company bank account write routes that allows authenticated attackers with third-party creation rights to create, replace, or delete bank a…","summary":"Dolibarr before 24.0.0 contains a broken object-level authorization vulnerability in the REST API company bank account write routes that allows authenticated attackers with third-party creation rights to create, replace, or delete bank a…","severity":"medium","cvss":6.5,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N","cwe":["CWE-639"],"vendor":"Dolibarr","product":"dolibarr","affected":["dolibarr < 24.0.0"],"published":"2026-08-24","updated":"2026-10-12","sourceUpdated":"2026-10-12T22:10:00.247","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-71507","references":[{"url":"https://codeant.ai/security-research/cve-2026-71507-dolibarr-bola-lets-attackers-redirect-supplier-payments","label":"disclosure@vulncheck.com"},{"url":"https://github.com/Dolibarr/dolibarr/commit/c100564d059e19c711317c734d302a90b11e2e8b","label":"disclosure@vulncheck.com"},{"url":"https://github.com/Dolibarr/dolibarr/releases/tag/24.0.0","label":"disclosure@vulncheck.com"},{"url":"https://www.vulncheck.com/advisories/dolibarr-rest-api-broken-object-level-authorization-via-bank-account-routes","label":"disclosure@vulncheck.com"}],"tags":["nvd","cve.org","exploit-available"],"epss":0.00389,"epssPercentile":0.32784,"exploitAvailable":true,"ssvc":{"exploitation":"poc","automatable":"no","technicalImpact":"partial","timestamp":"2026-08-24T20:00:59.623508Z"},"ingestedAt":"2026-09-08T21:11:12.284Z","slug":"CVE-2026-71507","body":"## Overview\n\nDolibarr before 24.0.0 contains a broken object-level authorization vulnerability in the REST API company bank account write routes that allows authenticated attackers with third-party creation rights to create, replace, or delete bank account details of any company without requiring read access to that company. Attackers can inject attacker-controlled IBANs as creditor accounts, which are then written into regenerated SEPA credit-transfer files, redirecting outgoing payments to attacker-controlled accounts.\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"twilight","depthScore":48,"depthScoreParts":{"impact":35.8,"likelihood":0.1,"exploitation":12,"ransomware":0},"changes":[{"seq":214494,"id":"CVE-2026-71507","ts":1790869835907,"field":"exploit_available","old":"false","new":"true"}]}