CVE-2026-71506: Dolibarr Auth Bypass Vulnerability

CVE-2026-71506 Overview

CVE-2026-71506 is an improper authorization vulnerability [CWE-863] in Dolibarr ERP/CRM versions before 24.0.0. The flaw resides in the payments REST API delete endpoint within htdocs/compta/facture/class/api_paiements.class.php. The endpoint checks for invoice-deletion rights instead of the intended payment-issuance rights. Any authenticated user granted invoice-deletion permissions can permanently delete arbitrary payment records through the API. Successful exploitation zeroes paid amounts on invoices and removes entries from accounting exports, breaking financial data integrity.

Critical Impact
Authenticated attackers with invoice-deletion rights can permanently delete any payment record, corrupting financial ledgers and accounting exports.

Affected Products

Dolibarr ERP/CRM versions prior to 24.0.0
Deployments exposing the Dolibarr REST API (/api/index.php/) to authenticated users
Instances where non-administrative roles have been granted invoice-deletion rights

Discovery Timeline

2026-08-24 - CVE-2026-71506 published to the National Vulnerability Database
2026-08-26 - Last updated in NVD database

Technical Details for CVE-2026-71506

Vulnerability Analysis

The vulnerability lies in Dolibarr's payments REST API DELETE endpoint. The handler validates the caller's permission to delete invoices rather than the permission to issue or manage payments. This constitutes a broken authorization control mapped to [CWE-863] (Incorrect Authorization).

Any authenticated principal holding the facture->supprimer (invoice deletion) right can invoke the payment deletion endpoint and remove payment rows from the database. The action is not restricted to payments the caller created and cannot be undone through the API. Deleted payments no longer contribute to invoice paid amounts, so previously settled invoices revert to an unpaid state, and their entries disappear from accounting exports. The result is silent corruption of financial records with no automatic reconciliation.

Root Cause

The root cause is a misconfigured permission check in the API method that deletes a payment. The routine gates access on the invoice-deletion right instead of the payment-management right. The fixed commit renames and reworks the check so the endpoint validates the correct payment permission before proceeding.

Attack Vector

The attacker must be authenticated to the Dolibarr instance and possess invoice-deletion rights. The attacker then issues an HTTP DELETE request to the payments REST API endpoint referencing an arbitrary payment identifier. No user interaction is required and the attack is fully network-reachable.

php

 	}
 
 	/**
-	 * Delete paiement
+	 * Delete payment
 	 *
 	 * @param   int     $id   Paiement ID
 	 * @return  array

Source: Dolibarr commit e01a12f — the surrounding change replaces the invoice-deletion permission check with the correct payment permission check.

Detection Methods for CVE-2026-71506

Indicators of Compromise

HTTP DELETE requests to Dolibarr REST API paths matching /api/index.php/payments/{id} in web server access logs
Unexpected removal of rows from the llx_paiement and related payment link tables
Invoices previously marked paid reverting to unpaid status without a corresponding refund workflow
Gaps or missing identifiers in accounting export files generated after the incident

Detection Strategies

Correlate REST API DELETE /payments/* calls with the authenticated user's role and flag any caller lacking payment-issuance rights.
Compare periodic snapshots of paid-invoice totals against current state to identify unexplained reductions.
Alert on any payment deletion outside of maintenance windows or performed by non-finance user accounts.

Monitoring Recommendations

Enable verbose logging on the Dolibarr API layer and forward events to a centralized log platform for retention and query.
Monitor Dolibarr audit trails for PAYMENT_DELETE events and cross-reference with the user role that performed the action.
Track baseline volumes of payment deletions and alert on statistical deviations.

How to Mitigate CVE-2026-71506

Immediate Actions Required

Upgrade Dolibarr to version 24.0.0 or later, which contains the corrected permission check.
Audit user roles and remove invoice-deletion rights from any account that does not strictly require them.
Review payment tables and accounting exports for unexpected deletions since the API was last exposed.

Patch Information

The fix is included in Dolibarr 24.0.0. The corrective change is applied in commit e01a12ffea4675f5bcc1c886f06ec6a29d5e4801, which updates the payment deletion endpoint in htdocs/compta/facture/class/api_paiements.class.php to test the correct payment permission. See the VulnCheck advisory and CodeAnt Security Research for additional analysis.

Workarounds

Disable the Dolibarr REST API module until the upgrade to 24.0.0 is completed.
Restrict network access to /api/index.php/ using a reverse proxy or web application firewall rule that blocks DELETE methods against the payments resource.
Revoke invoice-deletion rights from all non-administrative roles as a temporary compensating control.

bash

# Example nginx rule to block DELETE requests to the payments API until patched
location ~ ^/api/index\.php/payments/ {
    limit_except GET POST PUT {
        deny all;
    }
    proxy_pass http://dolibarr_backend;
}