# CVE-2026-81729: Dolibarr REST API authorization bypass in document deletion

Source: https://junglewise.ai/threats/cve-2026-81729-dolibarr-rest-api-authorization-bypass-in-document-deletion  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-08-27. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-81729 · Severity: medium · CVSS 6.5 · Published 2026-08-27

Dolibarr is an open-source ERP/CRM system that manages business documents such as invoices, orders, and proposals. An authenticated API user with only read permissions can permanently delete documents and generated PDFs that they should not be able to modify, bypassing intended access controls and leaving no recovery path for deleted files.

Technologies: [Dolibarr Crm](https://junglewise.ai/threats/technologies/crm), [Dolibarr](https://junglewise.ai/threats/technologies/dolibarr), [Dolibarr Erp\](https://junglewise.ai/threats/technologies/dolibarr-erp). Vendors: [Dolibarr](https://junglewise.ai/threats/vendors/dolibarr).

## Quick answers

**Is CVE-2026-81729 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-81729 being exploited in the wild.

**How severe is CVE-2026-81729?** Medium severity, with a CVSS score of 6.5, published 27 August 2026.

**Which products and versions are affected?** Dolibarr before 23.0.4.

**Is there a fix for CVE-2026-81729?** A patch was published on 2026: Fixed in version 23.0.4 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-81729 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-81729?** Check whether you run Dolibarr Crm, Dolibarr or Dolibarr Erp\ at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability is an authorization bypass in the Documents::delete() REST API method. The flaw occurs in htdocs/api/class/api_documents.class.php where dol_check_secure_access_document() is called with mode 'read' instead of 'write' when processing DELETE /api/index.php/documents requests. This allows an authenticated user holding only read permissions (e.g., societe:lire or facture:lire) to pass the permission check and delete documents in modules they can only read. An attacker needs valid API credentials with read access to a document-bearing module; no network-level authentication bypass is required. The impact is permanent deletion of third-party files, invoices, orders, proposals, and PDFs with no recovery mechanism. The fix was applied in version 23.0.4, which correctly passes 'write' mode to the permission check function.

## Affected products

- Dolibarr Dolibarr before 23.0.4

## Timeline

- 2026-08-27: disclosed
- 2026: patched: Fixed in version 23.0.4

## References

- [https://github.com/Dolibarr/dolibarr](https://github.com/Dolibarr/dolibarr)
- [https://github.com/Dolibarr/dolibarr/blob/23.0.3/htdocs/api/class/api_documents.class.php](https://github.com/Dolibarr/dolibarr/blob/23.0.3/htdocs/api/class/api_documents.class.php)

## Related threats

- [Dolibarr authorization bypass in expense report payments API](https://junglewise.ai/threats/cve-2026-125754-dolibarr-20-0-0-through-23-0-4-and-24-x-before-24-0-2-contains)
- [Dolibarr CSP mechanism bypass in document.php](https://junglewise.ai/threats/cve-2026-112361-a-vulnerability-has-been-found-in-dolibarr-up-to-23-0-2-the)
- [Dolibarr authorization bypass in document storage endpoints](https://junglewise.ai/threats/cve-2026-89013-dolibarr-authorization-bypass-in-document-storage-endpoints)
- [Dolibarr case-sensitive denylist bypass in sqlfilters API](https://junglewise.ai/threats/cve-2026-89012-dolibarr-case-sensitive-denylist-bypass-in-sqlfilters-api)
- [Dolibarr Legacy File Manager improper access control](https://junglewise.ai/threats/cve-2026-85401-dolibarr-legacy-file-manager-improper-access-control)