CVE-2026-71505 · The read desk checks your ID. The write desk doesn't.

CVSS 8.1 · Broken object-level authorization (CWE-639) · Fixed in Dolibarr 24.0.0 The clerk who shows you a file first checks it's yours. The clerk who resets the password on that file never checks, s