---
id: CVE-2026-71505
title: >-
  Dolibarr before 24.0.0 contains a broken object-level authorization
  vulnerability in the REST API third-party site account write routes that
  allows authenticated attackers with third-party creation rights to overwrite
  the WebPortal passw…
summary: >-
  Dolibarr before 24.0.0 contains a broken object-level authorization
  vulnerability in the REST API third-party site account write routes that
  allows authenticated attackers with third-party creation rights to overwrite
  the WebPortal passw…
severity: high
cvss: 7.1
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N'
cwe:
  - CWE-639
published: '2026-08-24'
updated: '2026-09-08'
sourceUpdated: '2026-09-08T20:23:49.880'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-71505'
references:
  - url: >-
      https://codeant.ai/security-research/cve-2026-71505-dolibarr-bola-enables-portal-account-takeover
    label: disclosure@vulncheck.com
  - url: >-
      https://github.com/Dolibarr/dolibarr/commit/4cf305ebb958eeffa921aad7c94de179b764f7e7
    label: disclosure@vulncheck.com
  - url: 'https://github.com/Dolibarr/dolibarr/releases/tag/24.0.0'
    label: disclosure@vulncheck.com
  - url: >-
      https://www.vulncheck.com/advisories/dolibarr-rest-api-broken-object-level-authorization-via-third-party-write-route
    label: disclosure@vulncheck.com
tags:
  - nvd
epss: 0.0041
epssPercentile: 0.32454
ingestedAt: '2026-09-08T21:11:12.284Z'
---

## Overview

Dolibarr before 24.0.0 contains a broken object-level authorization vulnerability in the REST API third-party site account write routes that allows authenticated attackers with third-party creation rights to overwrite the WebPortal password of any company by bypassing per-object access checks that are only enforced on read routes. Attackers can replace the victim company's WebPortal password through the write endpoint, authenticate as that company to access its invoice data, and also obtain the victim's previous password verifier from the API response.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.