CVE-2026-71507 — Dolibarr < 24.0.0 REST API Broken Object-Level Authorization via Bank Account Routes
Dolibarr before 24.0.0 contains a broken object-level authorization vulnerability in the REST API company bank account write routes that allows authenticated attackers with thir…
Published: 2026-08-24 · CVSS: 7.1 · CVSS 4.0
Dolibarr before 24.0.0 contains a broken object-level authorization vulnerability in the REST API company bank account write routes that allows authenticated attackers with third-party creation rights to create, replace, or delete bank account details of any company without requiring read access to that company. Attackers can inject attacker-controlled IBANs as creditor accounts, which are then written into regenerated SEPA credit-transfer files, redirecting outgoing payments to attacker-controlled accounts.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7