7 matches found
CVE-2026-71506 Dolibarr < 24.0.0 Payments REST API Improper Authorization via Delete Endpoint
Dolibarr before 24.0.0 contains an improper authorization vulnerability in the payments REST API delete endpoint that allows authenticated attackers with invoice-deletion rights to permanently delete any payment record by bypassing the intended payment-issuance rights check. Attackers can exploit...
EUVD-2026-65079
Dolibarr before 24.0.0 contains an improper authorization vulnerability in the payments REST API delete endpoint that allows authenticated attackers with invoice-deletion rights to permanently delete any payment record by bypassing the intended payment-issuance rights check. Attackers can exploit...
CVE-2026-71506 Dolibarr < 24.0.0 Payments REST API Improper Authorization via Delete Endpoint
Dolibarr before 24.0.0 contains an improper authorization vulnerability in the payments REST API delete endpoint that allows authenticated attackers with invoice-deletion rights to permanently delete any payment record by bypassing the intended payment-issuance rights check. Attackers can exploit...
CVE-2026-71506 Dolibarr < 24.0.0 Payments REST API Improper Authorization via Delete Endpoint
Dolibarr before 24.0.0 contains an improper authorization vulnerability in the payments REST API delete endpoint that allows authenticated attackers with invoice-deletion rights to permanently delete any payment record by bypassing the intended payment-issuance rights check. Attackers can exploit...
PT-2026-81001
Name of the Vulnerable Software and Affected Versions Dolibarr versions prior to 24.0.0 Description An improper authorization issue exists in the payments REST API delete endpoint. Authenticated attackers with invoice-deletion rights can bypass the required payment-issuance rights check to...
CVE-2026-72907 ERPNext: Broken Access Control on certain endpoint
ERPNext is a free and open source Enterprise Resource Planning tool. Prior to 15.111.0 and 16.22.0, the addac function in erpnext/accounts/utils.py accepts the ignorepermissions argument without enforcing Account create permission, allowing an authenticated limited user to create unauthorized...
CVE-2026-72907 ERPNext: Broken Access Control on certain endpoint
ERPNext is a free and open source Enterprise Resource Planning tool. Prior to 15.111.0 and 16.22.0, the addac function in erpnext/accounts/utils.py accepts the ignorepermissions argument without enforcing Account create permission, allowing an authenticated limited user to create unauthorized...