Dolibarr ERP CVE-2026-71506

The attacker must hold an authenticated Dolibarr session with the invoice-deletion permission assigned to their role - this is the exact misconfigured gate the vulnerability exploits. No elevated administrator privilege is required; a standard accounting user role that includes invoice-deletion rights is sufficient. The vulnerable endpoint is the payments REST API delete path; the Dolibarr REST API must be enabled and network-accessible to the attacker. No special non-default configuration beyond role assignment is required. Limiting factors: unauthenticated attackers cannot exploit this (PR:L); users without any invoice-deletion rights are not affected; and the impact is limited to integrity and availability of payment and accounting data with no confidentiality exposure (VC:N).

The CVSS 4.0 score of 7.2 with vector AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:H accurately reflects a network-accessible flaw exploitable by low-privileged authenticated users with no interaction required, producing high integrity and high availability impact on the vulnerable system. The absence of a confidentiality impact (VC:N) narrows the blast radius to data destruction rather than exfiltration. The publicly available POC significantly elevates practical risk beyond what the score alone conveys - any authenticated Dolibarr user with invoice-deletion rights (a common role delegation in accounting workflows) becomes a threat actor. No KEV listing means active in-the-wild exploitation is not confirmed, but the low attack complexity and available exploit code mean the exploitation window for unpatched systems is narrow. EPSS data was not provided in source intelligence; exploitation probability must be inferred from POC availability and AC:L rather than empirical scan data. The financial data integrity consequence - zeroing paid invoice amounts and corrupting accounting exports - carries regulatory and audit risk beyond the immediate technical impact, meaning organizations subject to financial compliance obligations should treat this as urgent regardless of CVSSv4 tier.

An attacker authenticated to Dolibarr with invoice-deletion rights - a role commonly assigned to accounting staff - discovers or obtains the payment record IDs via normal application use or API enumeration, then issues DELETE requests to the payments REST API endpoint for target records. The endpoint's misconfigured permission check approves the deletion because the caller holds invoice-deletion rights, without verifying payment-issuance authority. A publicly available POC, referenced by codeant.ai security research, demonstrates this flow and enables rapid weaponization.