Description

Dolibarr before 24.0.0 contains a broken object-level authorization vulnerability in the REST API third-party site account write routes that allows authenticated attackers with third-party creation rights to overwrite the WebPortal password of any company by bypassing per-object access checks that are only enforced on read routes. Attackers can replace the victim company's WebPortal password through the write endpoint, authenticate as that company to access its invoice data, and also obtain the victim's previous password verifier from the API response.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.1",
  "pubDate": "2026-08-24T19:16:49.817Z",
  "pubdate": "2026-08-24T19:16:49.817Z",
  "executiveSummary": "Dolibarr before 24.0.0 suffers from a broken object-level authorization (BOLA) vulnerability within the REST API third-party site account write routes.\nThe flaw enables authenticated attackers possessing third-party creation rights to overwrite the WebPortal password of arbitrary companies by completely bypassing per-object access controls.\nThese security checks are improperly enforced exclusively on read routes rather than write endpoints.\nSuccessful exploitation allows an attacker to replace a victim company's WebPortal password, authenticate as that specific company to exfiltrate sensitive invoice data, and retrieve the victim's previous password verifier directly from the API response.\nThis introduces severe risks to data confidentiality and integrity, compromising multi-tenant isolation within the WebPortal environment.\nThe attack requires valid authentication with low-privilege third-party creation permissions, lowering the barrier for exploitation across exposed REST API interfaces.",
  "technicalDetails": "The root cause of this vulnerability lies in inconsistent authorization enforcement across the REST API architecture of Dolibarr.\nWhile read routes for third-party site accounts correctly implement per-object access checks to restrict users to authorized entities, the corresponding write routes lack these critical validation mechanisms.\nConsequently, a broken object-level authorization (BOLA) condition arises.\nAn attacker with standard authentication and third-party creation privileges can target arbitrary company identifiers within the write route parameters.\nThe step-by-step attack flow begins with the attacker identifying the target company's unique object identifier.\nThe attacker then crafts a malicious HTTP write request destined for the vulnerable REST API endpoint, supplying the targeted victim ID along with a new WebPortal password payload.\nBecause the backend application fails to verify whether the authenticated user possesses administrative rights or ownership over the specified object, the write operation executes successfully.\nThe server overwrites the victim company's existing WebPortal credentials in the database.\nDuring this transaction, the API response inadvertently leaks the victim's previous password verifier, exposing additional cryptographic artifacts.\nArmed with the newly assigned password, the attacker authenticates to the WebPortal under the guise of the victim company.\nOnce authenticated, the attacker accesses unauthorized resources, specifically targeting confidential invoice data and other proprietary financial records.\nThe vulnerable component involves the REST API controller logic governing third-party site account modifications in Dolibarr versions prior to 24.0.0, exposing network-accessible endpoints to unauthorized object manipulation."
}