Dolibarr up to 23.0.3 Document Deletion API api_documents.class.php Documents::delete mode privileges management

Summaryinfo

A vulnerability marked as problematic has been reported in Dolibarr up to 23.0.3. This affects the function Documents::delete of the file htdocs/api/class/api_documents.class.php of the component Document Deletion API. Performing a manipulation of the argument mode results in privileges management. This vulnerability was named CVE-2026-81729. The attack may be initiated remotely. There is no available exploit.

Detailsinfo

A vulnerability was found in Dolibarr up to 23.0.3. It has been classified as problematic. This affects the function Documents::delete of the file htdocs/api/class/api_documents.class.php of the component Document Deletion API. The manipulation of the argument mode with an unknown input leads to a privileges management vulnerability. CWE is classifying the issue as CWE-269. The product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor. This is going to have an impact on integrity. The summary by CVE is:

Dolibarr before 23.0.4 authorizes REST API document deletion against the wrong permission. Documents::delete() in htdocs/api/class/api_documents.class.php calls dol_check_secure_access_document() with the mode argument 'read' when handling DELETE /api/index.php/documents, while the sibling builddoc() path passes 'write', the correct mode for an operation that modifies stored data. An authenticated API user who holds only a read permission for a document-bearing module, for example societe:lire or facture:lire, and no create, write, delete or admin permission, therefore passes the check and can permanently delete that module's documents: third-party files, invoices, orders, proposals, project files and generated PDFs, with no recovery path. The call site is htdocs/api/class/api_documents.class.php:1276 in 23.0.3 and passes 'write' from 23.0.4 onward.

The advisory is shared at github.com. This vulnerability is uniquely identified as CVE-2026-81729 since 08/27/2026. The exploitability is told to be easy. It is possible to initiate the attack remotely. Technical details are known, but no exploit is available. MITRE ATT&CK project uses the attack technique T1068 for this issue.

By approaching the search of inurl:htdocs/api/class/api_documents.class.php it is possible to find vulnerable targets with Google Hacking.

Upgrading to version 23.0.4 eliminates this vulnerability. Applying the patch de1d7a623e98484cc71fe43e93fdd5cd796abee5 is able to eliminate this problem.

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Productinfo

Type

• Enterprise Resource Planning Software

Name

• Dolibarr

Version

• 23.0.0
• 23.0.1
• 23.0.2
• 23.0.3

License

• open-source

Website

• Product: https://github.com/Dolibarr/dolibarr/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Discussion