VULNERABILITY INTELLIGENCE
CVE-2026-71506
CVSS score8.1 HIGH
EPSS probability0.54%
CISA KEVNot currently listed
Published2026-08-24
Last modified2026-10-12
CVSS vectorCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H
Description
Dolibarr before 24.0.0 contains an improper authorization vulnerability in the payments REST API delete endpoint that allows authenticated attackers with invoice-deletion rights to permanently delete any payment record by bypassing the intended payment-issuance rights check. Attackers can exploit this misconfigured permission check to zero paid amounts on invoices and remove entries from accounting exports, causing financial data integrity loss.
Weakness classification
- disclosure@vulncheck.com: CWE-863