CVE-2026-71506 · The wrong key on the lock
CVSS 6.5 · Wrong-permission authorization (CWE-863) · Fixed in Dolibarr 24.0.0
The button labelled “delete a draft invoice” is wired to the vault that holds recorded payments. Press it and money that
security-research.hashnode.dev5 min read