CVE-2026-81729

CVE-2026-81729 is an incorrect-authorization flaw (CWE-863) in the Dolibarr ERP/CRM REST API, where document deletion is authorized against the wrong permission mode. When an authenticated API user calls DELETE /api/index.php/documents, Documents::delete() in htdocs/api/class/api_documents.class.php (line 1276 in 23.0.3) calls dol_check_secure_access_document() with mode 'read' instead of the 'write' mode used by the sibling builddoc() path, so a data-modifying operation is checked as if it were a read. Consequently, any API user holding only a read permission on a document-bearing module, such as societe:lire or facture:lire, and no create, write, delete or admin rights, can permanently delete that module's stored files — third-party documents, invoices, orders, proposals, project files and generated PDFs — with no recovery path. All Dolibarr deployments before 23.0.4 that expose the REST API are affected, and the call site correctly passes 'write' from 23.0.4 onward. No public proof-of-concept is known and exploitation has not been reported in the wild; the flaw carries a CVSS 4.0 score of 7.1 (High, integrity-only impact) and EPSS estimates about 0.2% probability of exploitation within 30 days.

What to do: Upgrade Dolibarr to 23.0.4 or later, which passes the correct 'write' mode at the delete call site. In the interim, audit REST API tokens, revoke or restrict read-only API credentials, and consider blocking or rate-limiting DELETE requests to /api/index.php/documents at a reverse proxy; review API logs for DELETE /documents calls made by low-privilege users to detect possible unauthorized deletions.