Dolibarr before 23.0.4 authorizes REST API document deletion against the wrong permission. (CVE-2026-81729)

In Dolibarr versions prior to 23.0.4, the REST API endpoint for deleting documents calls the function dol_check_secure_access_document() with the mode argument set to 'read' instead of 'write'. This incorrect permission check allows an authenticated API user who has only read permissions (e.g., societe:lire or facture:lire) and lacks create, write, delete, or admin permissions to delete documents associated with those modules. The vulnerability affects document deletion operations including third-party files, invoices, orders, proposals, project files, and generated PDFs. The flaw was corrected in version 23.0.4 by changing the mode argument to 'write' in the relevant API code.

An authenticated user with only read permissions on document-bearing modules can delete documents permanently without having the appropriate write or delete permissions. This leads to unauthorized data modification and loss of important documents with no recovery path. The integrity of document data is compromised, but confidentiality and availability are not directly affected. The vulnerability has a CVSS score of 6.5, indicating a high severity impact primarily due to unauthorized integrity modification.

Upgrade Dolibarr to version 23.0.4 or later, where the permission check for document deletion in the REST API has been corrected to require 'write' access. Until the upgrade is applied, restrict API user permissions to prevent users with only read access from accessing the document deletion endpoint. No other mitigations are specified.