---
id: CVE-2026-71505
title: >-
  Dolibarr before 24.0.0 contains a broken object-level authorization
  vulnerability in the REST API third-party site account write routes that
  allows authenticated attackers with third-party creation rights to overwrite
  the WebPortal passw…
summary: >-
  Dolibarr before 24.0.0 contains a broken object-level authorization
  vulnerability in the REST API third-party site account write routes that
  allows authenticated attackers with third-party creation rights to overwrite
  the WebPortal passw…
severity: high
cvss: 7.1
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N'
cwe:
  - CWE-639
vendor: Dolibarr
product: dolibarr
affected:
  - dolibarr < 24.0.0
published: '2026-08-24'
updated: '2026-10-12'
sourceUpdated: '2026-10-12T22:10:00.247'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-71505'
references:
  - url: >-
      https://codeant.ai/security-research/cve-2026-71505-dolibarr-bola-enables-portal-account-takeover
    label: disclosure@vulncheck.com
  - url: >-
      https://github.com/Dolibarr/dolibarr/commit/4cf305ebb958eeffa921aad7c94de179b764f7e7
    label: disclosure@vulncheck.com
  - url: 'https://github.com/Dolibarr/dolibarr/releases/tag/24.0.0'
    label: disclosure@vulncheck.com
  - url: >-
      https://www.vulncheck.com/advisories/dolibarr-rest-api-broken-object-level-authorization-via-third-party-write-route
    label: disclosure@vulncheck.com
tags:
  - nvd
  - cve.org
  - exploit-available
epss: 0.0041
epssPercentile: 0.351
exploitAvailable: true
ssvc:
  exploitation: poc
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-08-24T19:28:11.201625Z'
ingestedAt: '2026-09-08T21:11:12.284Z'
---

## Overview

Dolibarr before 24.0.0 contains a broken object-level authorization vulnerability in the REST API third-party site account write routes that allows authenticated attackers with third-party creation rights to overwrite the WebPortal password of any company by bypassing per-object access checks that are only enforced on read routes. Attackers can replace the victim company's WebPortal password through the write endpoint, authenticate as that company to access its invoice data, and also obtain the victim's previous password verifier from the API response.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.