https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Fri, 09 Oct 2026 22:24:55 +0000 https://cve.radiocsirt.org/vuln/cve-2026-71505 <p><strong>Affected:</strong> dolibarr</p> <p>Dolibarr before 24.0.0 contains a broken object-level authorization vulnerability in the REST API third-party site account write routes that allows authenticated attackers with third-party creation rights to overwrite the WebPortal password of any company by bypassing per-object access checks that are only enforced on read routes. Attackers can replace the victim company&#39;s WebPortal password through the write endpoint, authenticate as that company to access its invoice data, and also obtain the victim&#39;s previous password verifier from the API response.</p> <p><strong>Affected:</strong> dolibarr</p> <p>Dolibarr before 24.0.0 contains a broken object-level authorization vulnerability in the REST API third-party site account write routes that allows authenticated attackers with third-party creation rights to overwrite the WebPortal password of any company by bypassing per-object access checks that are only enforced on read routes. Attackers can replace the victim company&#39;s WebPortal password through the write endpoint, authenticate as that company to access its invoice data, and also obtain the victim&#39;s previous password verifier from the API response.</p> https://cve.radiocsirt.org/vuln/cve-2026-71505