CVE-2026-71507 Dolibarr CVE debrief

Who should care

Defenders responsible for Dolibarr installations, particularly those with third-party creation rights enabled, should assess exposure and prioritize remediation. System administrators and security teams overseeing financial or ERP systems should verify their configurations and monitor for suspicious activity.

Why it matters

CVE-2026-71507 is a high-severity vulnerability in Dolibarr's REST API that allows authenticated attackers to manipulate bank account details of any company. Defenders should prioritize verification, updating, and monitoring to prevent potential financial losses and unauthorized control.

• Potential unauthorized redirection of payments to attacker-controlled accounts.
• Possible financial loss due to malicious bank account changes.
• Need for verification of Dolibarr version and configuration.
• Requirement for enhanced monitoring of bank account operations.

Technical summary

The vulnerability exists in Dolibarr's REST API company bank account write routes, allowing authenticated attackers with third-party creation rights to create, replace, or delete bank account details of any company. This is due to a broken object-level authorization mechanism. Attackers can inject malicious IBANs as creditor accounts, which are then written into regenerated SEPA credit-transfer files, potentially redirecting outgoing payments to attacker-controlled accounts.

Defensive priority

Defenders should prioritize verifying and updating Dolibarr installations to version 24.0.0 or later, and restrict third-party creation rights. Monitoring for suspicious bank account changes and ensuring proper authorization checks are in place is crucial.

Recommended defensive actions

• Verify and update Dolibarr installations to version 24.0.0 or later.
• Restrict third-party creation rights in the REST API.
• Monitor for suspicious bank account changes.
• Ensure proper authorization checks are in place for bank account operations.
• Review compensating controls for exposed systems while remediation is scheduled and verified.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.

Evidence notes

The CVE record and NVD entry provide details on the vulnerability. However, the exact scope of affected versions and deployments requires further verification from official sources. The vulnerability was reported by Codeant.ai security research and fixed in Dolibarr version 24.0.0. Official CVE Program record and NIST NVD detail page provide additional information. However, defenders should verify the affected scope, severity, and vendor guidance for their specific deployments. Compensating controls and monitoring for suspicious bank

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.