https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Tue, 06 Oct 2026 07:49:52 +0000 https://cve.radiocsirt.org/vuln/euvd-2026-380377 EUVD-2026-380377 https://cve.radiocsirt.org/vuln/euvd-2026-380377 https://cve.radiocsirt.org/vuln/fkie_cve-2026-71505 <p>Dolibarr before 24.0.0 contains a broken object-level authorization vulnerability in the REST API third-party site account write routes that allows authenticated attackers with third-party creation rights to overwrite the WebPortal password of any company by bypassing per-object access checks that are only enforced on read routes. Attackers can replace the victim company&#39;s WebPortal password through the write endpoint, authenticate as that company to access its invoice data, and also obtain the victim&#39;s previous password verifier from the API response.</p> <p>Dolibarr before 24.0.0 contains a broken object-level authorization vulnerability in the REST API third-party site account write routes that allows authenticated attackers with third-party creation rights to overwrite the WebPortal password of any company by bypassing per-object access checks that are only enforced on read routes. Attackers can replace the victim company&#39;s WebPortal password through the write endpoint, authenticate as that company to access its invoice data, and also obtain the victim&#39;s previous password verifier from the API response.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-71505 https://cve.radiocsirt.org/vuln/ghsa-c275-q2j8-wwg9 <p>Dolibarr before 24.0.0 contains a broken object-level authorization vulnerability in the REST API third-party site account write routes that allows authenticated attackers with third-party creation rights to overwrite the WebPortal password of any company by bypassing per-object access checks that are only enforced on read routes. Attackers can replace the victim company&#39;s WebPortal password through the write endpoint, authenticate as that company to access its invoice data, and also obtain the victim&#39;s previous password verifier from the API response.</p> <p>Dolibarr before 24.0.0 contains a broken object-level authorization vulnerability in the REST API third-party site account write routes that allows authenticated attackers with third-party creation rights to overwrite the WebPortal password of any company by bypassing per-object access checks that are only enforced on read routes. Attackers can replace the victim company&#39;s WebPortal password through the write endpoint, authenticate as that company to access its invoice data, and also obtain the victim&#39;s previous password verifier from the API response.</p> https://cve.radiocsirt.org/vuln/ghsa-c275-q2j8-wwg9