CVE-2026-71505

Descripción

Dolibarr before 24.0.0 contains a broken object-level authorization vulnerability in the REST API third-party site account write routes that allows authenticated attackers with third-party creation rights to overwrite the WebPortal password of any company by bypassing per-object access checks that are only enforced on read routes. Attackers can replace the victim company-s WebPortal password through the write endpoint, authenticate as that company to access its invoice data, and also obtain the victim-s previous password verifier from the API response.