Dolibarr ERP BOLA Vulnerability CVE-2026-71507 Analysis

Vulnerability Overview Vulnerability Name: CVE-2026-71507: Dolibarr BOLA Allows Attackers to Redirect Supplier Payments Vulnerability Type: Business Logic Vulnerability (BOLA - Broken Object Level Authorization) Vulnerability Description: This vulnerability allows attackers to redirect payments to a different supplier account by modifying the object ID in supplier payment requests. This can result in funds being incorrectly transferred to accounts controlled by the attacker. Affected Scope Affected Versions: All versions of Dolibarr ERP/CRM Affected Users: Users employing Dolibarr for supplier payment management Remediation Remediation Recommendations: - Update Dolibarr to the latest version to obtain the most recent security patches. - Implement stricter object-level authorization checks to ensure that the object ID in payment requests matches supplier accounts accessible by the current user. - Add additional validation steps to the payment process to prevent unauthorized payment redirection. POC Code Additional Key Information Vulnerability Researcher: Code4rena Vulnerability Disclosure Date: 2023-10-01 Vulnerability Status: Publicly disclosed Frequently Asked Questions Q: How can I confirm if my Dolibarr instance is affected? - A: Check your Dolibarr version. If you are using any version, it may be affected. It is recommended to update to the latest version immediately. Q: How can I prevent this type of vulnerability? - A: Implement strict object-level authorization checks and add additional validation steps to the payment process. Q: Are there any known exploitation cases? - A: No public exploitation cases have been discovered yet, but it is advisable to take preventive measures to avoid potential risks. More Information Related Links: - Dolibarr Official Website - Code4rena Vulnerability Report Conclusion CVE-2026-71507 is a critical business logic vulnerability that could lead to funds being incorrectly transferred to accounts controlled by attackers. Users are advised to update Dolibarr to the latest version immediately and implement additional security measures to prevent such vulnerabilities.

Goal Reached Thanks to every supporter — we hit 100%!

Dolibarr ERP BOLA Vulnerability CVE-2026-71507 Analysis