Executive brief
Dolibarr is an open-source ERP/CRM system that manages business documents such as invoices, orders, and proposals. An authenticated API user with only read permissions can permanently delete documents and generated PDFs that they should not be able to modify, bypassing intended access controls and leaving no recovery path for deleted files.
Technical details
The vulnerability is an authorization bypass in the Documents::delete() REST API method. The flaw occurs in htdocs/api/class/api_documents.class.php where dol_check_secure_access_document() is called with mode 'read' instead of 'write' when processing DELETE /api/index.php/documents requests. This allows an authenticated user holding only read permissions (e.g., societe:lire or facture:lire) to pass the permission check and delete documents in modules they can only read. An attacker needs valid API credentials with read access to a document-bearing module; no network-level authentication bypass is required. The impact is permanent deletion of third-party files, invoices, orders, proposals, and PDFs with no recovery mechanism. The fix was applied in version 23.0.4, which correctly passes 'write' mode to the permission check function.
Affected products
- Dolibarr Dolibarr before 23.0.4
Timeline
- 2026-08-27: disclosed
- 2026: patched: Fixed in version 23.0.4