{"apiVersion":"1.0","identifier":"CVE-2026-81729","description":"Dolibarr before 23.0.4 authorizes REST API document deletion against the wrong permission. Documents::delete() in htdocs/api/class/api_documents.class.php calls dol_check_secure_access_document() with the mode argument -read- when handling DELETE /api/index.php/documents, while the sibling builddoc() path passes -write-, the correct mode for an operation that modifies stored data. An authenticated API user who holds only a read permission for a document-bearing module, for example societe:lire or facture:lire, and no create, write, delete or admin permission, therefore passes the check and can permanently delete that module-s documents: third-party files, invoices, orders, proposals, project files and generated PDFs, with no recovery path. The call site is htdocs/api/class/api_documents.class.php:1276 in 23.0.3 and passes -write- from 23.0.4 onward.","publishedAt":"2026-08-27T20:18:55","lastModifiedAt":"2026-08-27T20:18:55","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-81729","cvssScore":6.5,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N","epssProbability":0.0022,"riskScore":0.66,"affectedProduct":"Dolibarr","affectedVersions":"<23.0.4","vulnerabilityType":"Web app","operatingSystems":[],"links":{"self":"https://www.redsauce.net/api/cves/CVE-2026-81729","webPages":{"es":"https://www.redsauce.net/es/cves/CVE-2026-81729","en":"https://www.redsauce.net/en/cves/CVE-2026-81729","fr":"https://www.redsauce.net/fr/cves/CVE-2026-81729","pt":"https://www.redsauce.net/pt/cves/CVE-2026-81729","de":"https://www.redsauce.net/de/cves/CVE-2026-81729","sk":"https://www.redsauce.net/sk/cves/CVE-2026-81729","el":"https://www.redsauce.net/el/cves/CVE-2026-81729"},"source":"https://nvd.nist.gov/vuln/detail/CVE-2026-81729"}}