Dolibarr ERP EUVD-2026-67234

Exploitation requires a valid Dolibarr REST API user account with at least one read-level permission grant for a document-bearing module - specifically any of: societe:lire (third-party files), facture:lire (invoices), commande:lire (orders), propal:lire (proposals), or projet:lire (project files). The Dolibarr REST API must be enabled and network-accessible, which is not the default in all deployment configurations. No write, delete, create, or admin permission is required - the incorrect mode argument means read-only grants are sufficient to pass the authorization gate. Exploitation is limited to authenticated users; unauthenticated access to the endpoint is not possible. Additionally, the attacker must be able to supply valid module part names and relative file paths to target specific documents, which may require prior reconnaissance of the document storage layout or API enumeration.

The CVSS 4.0 score of 7.1 accurately characterizes the attack surface: network-reachable (AV:N), low complexity (AC:L), no special attack conditions (AT:N), low privilege required (PR:L), no user interaction (UI:N), and high integrity impact on the vulnerable system (VI:H) with no confidentiality or availability loss. The PR:L requirement is the primary limiting factor - unauthenticated exploitation is not possible, which reduces the opportunistic attack surface compared to PR:N flaws. However, in multi-tenant or partner-integrated Dolibarr deployments where read-only API accounts are distributed to third parties, the privilege bar is readily met. The integrity impact is severe and irreversible: there is no recovery path for deleted documents, making this a data-destruction risk rather than a data-exfiltration one. No EPSS score was provided; no CISA KEV listing is present, indicating no confirmed active exploitation at time of analysis. The publicly committed diff is a meaningful exploitation-enablement signal - any API user aware of the flaw can act on it immediately without further research. Organizations running the Dolibarr REST API with distributed accounts should treat this as high operational priority despite the absence of KEV.

An attacker holding a legitimate read-only partner API account (e.g., with societe:lire for CRM access) authenticates to the Dolibarr REST API and sends DELETE /api/index.php/documents requests targeting third-party files or invoice PDFs. The authorization check passes because it evaluates only read-level grants, and the documents are permanently deleted with no recovery path. The publicly visible one-line commit diff at the fix commit makes the necessary request structure straightforward to derive for any holder of API credentials.