Dolibarr ERP CVE-2026-71505

The attacker must hold a valid Dolibarr account with 'third-party creation rights' - a specific permission level below full administrator that may be assigned to partner users, resellers, or lower-privilege internal staff. The Dolibarr REST API must be enabled and reachable from the attacker's network location (not firewalled or disabled). No non-default configuration beyond API enablement is required; the flaw exists in the default handling of write routes. Exploitation is strictly limited to authenticated users - unauthenticated exploitation is not possible given PR:L in the CVSS vector. The follow-on impact (invoice data access) is further limited to instances where the WebPortal feature is enabled and victim companies have active WebPortal accounts; if WebPortal is disabled, the credential overwrite has no exploitable downstream consequence, though the write-route authorization bypass remains present.

The CVSS 4.0 score of 7.1 (AV:N/AC:L/AT:N/PR:L/UI:N) accurately captures the threat profile: network-accessible, low complexity, no special attack prerequisites, but gated behind a valid low-privilege account. The high integrity impact (VI:H) reflects unconditional overwrite of any company's WebPortal credentials, and the low confidentiality impact (VC:L) corresponds to the leaked prior password verifier. This is a real operational priority, not a theoretical risk: the public PoC (referenced via codeant.ai and VulnCheck) substantially lowers the exploitation barrier for any authenticated Dolibarr user. The vulnerability is not currently listed in CISA KEV, suggesting no confirmed widespread active exploitation at time of analysis, but the BOLA class is consistently among the most abused API vulnerability patterns in practice. The absence of EPSS data in the input prevents a probability-based comparison, but given the PoC availability and low complexity, exploitation likelihood is assessed as elevated. No CVSS signal conflicts are present - the network vector and low-privilege requirement are consistent with the description.

An authenticated Dolibarr user with only 'third-party creation rights' - a non-administrative permission that may be granted to partner accounts or internal staff - enumerates company IDs via the API read endpoint and then sends a crafted REST API write request targeting a victim company's third-party site account, substituting the victim's ID and a password they control. With the password replaced, the attacker logs into the victim company's WebPortal and browses its invoice history. A public proof-of-concept is available at https://codeant.ai/security-research/cve-2026-71505-dolibarr-bola-enables-portal-account-takeover, providing a ready exploitation path for any authenticated platform user.