CVE-2026-81729
MediumCVSS 6.5Exploitation Probability (EPSS)
Low risk12th percentile - higher than 12% of all known CVEs
Summary
Dolibarr before 23.0.4 authorizes REST API document deletion against the wrong permission. Documents::delete() calls dol_check_secure_access_document() with mode 'read' instead of 'write', allowing an authenticated user with only read permissions to permanently delete module documents.
Risk Assessment
A user with minimal privileges can irreversibly delete critical documents such as invoices, orders, third-party files, and generated PDFs, leading to data loss and business disruption.
Recommendation
Upgrade Dolibarr to version 23.0.4 or later where the mode is fixed to 'write'. Review API user permissions and restrict delete operations.
Original NVD description (English source)
Dolibarr before 23.0.4 authorizes REST API document deletion against the wrong permission. Documents::delete() in htdocs/api/class/api_documents.class.php calls dol_check_secure_access_document() with the mode argument 'read' when handling DELETE /api/index.php/documents, while the sibling builddoc() path passes 'write', the correct mode for an operation that modifies stored data. An authenticated API user who holds only a read permission for a document-bearing module, for example societe:lire or facture:lire, and no create, write, delete or admin permission, therefore passes the check and can permanently delete that module's documents: third-party files, invoices, orders, proposals, project files and generated PDFs, with no recovery path. The call site is htdocs/api/class/api_documents.class.php:1276 in 23.0.3 and passes 'write' from 23.0.4 onward.