Description

Dolibarr before 24.0.0 contains an improper authorization vulnerability in the payments REST API delete endpoint that allows authenticated attackers with invoice-deletion rights to permanently delete any payment record by bypassing the intended payment-issuance rights check. Attackers can exploit this misconfigured permission check to zero paid amounts on invoices and remove entries from accounting exports, causing financial data integrity loss.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.1",
  "pubDate": "2026-08-24T19:16:49.960Z",
  "pubdate": "2026-08-24T19:16:49.960Z",
  "executiveSummary": "An improper authorization vulnerability exists within the payments REST API delete endpoint of Dolibarr prior to version 24.0.0. The flaw permits authenticated attackers who possess invoice-deletion rights to permanently delete arbitrary payment records by bypassing the intended security controls that normally enforce payment-issuance rights checks. Successful exploitation of this misconfigured permission check allows malicious actors to effectively zero out paid amounts on invoices and systematically remove critical entries from accounting exports. This behavior introduces severe financial data integrity loss and operational discrepancies within the targeted financial management system. The attack requires authentication and specific invoice-deletion privileges, but leverages the insecure direct object manipulation via the REST API to escalate operational impact beyond the user's intended authorization scope.",
  "technicalDetails": "The vulnerability resides in the REST API endpoint responsible for processing payment deletions within Dolibarr versions prior to 24.0.0. The root cause of the security defect is an improper authorization check wherein the application validates the user against invoice-deletion rights rather than verifying the requisite payment-issuance or payment-management administrative privileges before executing the deletion query.\nExploitation of this vulnerability occurs over the network via HTTP requests directed at the vulnerable payments REST API delete endpoint. An attacker must first authenticate to the Dolibarr application and obtain a session or API token possessing standard invoice-deletion capabilities. By crafting a targeted deletion request against specific payment record identifiers, the authenticated actor can bypass the intended permission boundary. Because the backend logic fails to validate whether the user holds the specific authorization to manage or issue payments, the application processes the deletion command against the specified payment object.\nUpon successful processing of the payload, the backend removes the payment record from the database. This post-exploitation state results in the immediate loss of financial tracking data, causing associated invoices to reflect zero paid amounts and purging the transaction entries from subsequent financial and accounting exports. The attack vector exposes systemic authorization flaws in API route handlers where privilege boundaries are improperly inherited or insufficiently scoped."
}