CVE-2026-81729

Katalog CVE

CVSS 6.5 · Medium EPSS 0,39%

Kerentanan Incorrect Authorization pada dolibarr erp/crm. Skor CVSS 3.1 6.5 (Medium) menurut vulncheck.com.

Deskripsi (NVD)

Dolibarr before 23.0.4 authorizes REST API document deletion against the wrong permission. Documents::delete() in htdocs/api/class/api_documents.class.php calls dol_check_secure_access_document() with the mode argument 'read' when handling DELETE /api/index.php/documents, while the sibling builddoc() path passes 'write', the correct mode for an operation that modifies stored data. An authenticated API user who holds only a read permission for a document-bearing module, for example societe:lire or facture:lire, and no create, write, delete or admin permission, therefore passes the check and can permanently delete that module's documents: third-party files, invoices, orders, proposals, project files and generated PDFs, with no recovery path. The call site is htdocs/api/class/api_documents.class.php:1276 in 23.0.3 and passes 'write' from 23.0.4 onward.

Rincian

Terbit di NVD

27 Agustus 2026

Terakhir diubah

31 Agustus 2026

Status NVD

Analyzed

CVSS 3.1

6.5 (Medium), sumber vulncheck.com
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-863: Incorrect Authorization

EPSS (30 hari)

0,39% peluang dieksploitasi; lebih tinggi dari 31,5% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/Dolibarr/dolibarr/commit/de1d7a623e98484cc71fe43e93fdd5cd796abee5 patch
• https://www.vulncheck.com/advisories/dolibarr-before-23.0.4-incorrect-authorization-on-rest-api-document-delet... patch · product · advisory pihak ketiga
• https://github.com/Dolibarr/dolibarr product
• https://github.com/Dolibarr/dolibarr/blob/23.0.3/htdocs/api/class/api_documents.class.php#L1276 release notes