Quick answers
- Is CVE-2026-81729 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-81729 being exploited in the wild.
- How severe is CVE-2026-81729?
- Medium severity, with a CVSS score of 6.5, published 27 August 2026.
- Which products and versions are affected?
- Dolibarr before 23.0.4.
- Is there a fix for CVE-2026-81729?
- A patch was published on 2026: Fixed in version 23.0.4 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2026-81729 attacked?
- It is attacked over the network, in a web application.
- Am I affected by CVE-2026-81729?
- Check whether you run Dolibarr Crm, Dolibarr or Dolibarr Erp\ at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
The vulnerability is an authorization bypass in the Documents::delete() REST API method. The flaw occurs in htdocs/api/class/api_documents.class.php where dol_check_secure_access_document() is called with mode 'read' instead of 'write' when processing DELETE /api/index.php/documents requests. This allows an authenticated user holding only read permissions (e.g., societe:lire or facture:lire) to pass the permission check and delete documents in modules they can only read. An attacker needs valid API credentials with read access to a document-bearing module; no network-level authentication bypass is required. The impact is permanent deletion of third-party files, invoices, orders, proposals, and PDFs with no recovery mechanism. The fix was applied in version 23.0.4, which correctly passes 'write' mode to the permission check function.
Affected products
- Dolibarr Dolibarr before 23.0.4
Timeline
- 2026-08-27: disclosed
- 2026: patched: Fixed in version 23.0.4