Dolibarr before 24.0.0 contains a broken object-level authorization vulnerability in the REST API third-party site account write routes that allows authenticated attackers with third-party creation rights to overwrite the WebPortal password of any company by bypassing per-object access checks that are only enforced on read routes. Attackers can replace the victim company's WebPortal password through the write endpoint, authenticate as that company to access its invoice data, and also obtain the victim's previous password verifier from the API response.

CVE-2026-71505 describes a broken object-level authorization (BOLA) vulnerability in Dolibarr versions prior to 24.0.0. The flaw exists in the REST API's third-party site account write routes, where per-object access checks are only enforced on read routes but not on write routes. Authenticated attackers with third-party creation rights can exploit this to overwrite the WebPortal password of any company without proper authorization. After overwriting the password, attackers can authenticate as the victim company and access sensitive invoice data. Additionally, the API response exposes the victim's previous password verifier, further compounding the risk. The vulnerability enables full account takeover of any company registered in the WebPortal. A fix was introduced in Dolibarr version 24.0.0, with the patch available on GitHub. Security researchers at CodeAnt AI and VulnCheck have published advisories detailing the exploitation mechanism. Organizations running Dolibarr below version 24.0.0 should upgrade immediately.