CVE-2026-71507 · Change one number, and the payroll run pays you

CVSS 6.5 · Object-level auth bypass → SEPA payment redirection (CWE-639) · Fixed in Dolibarr 24.0.0 You can't see a supplier's account, but you can quietly edit the bank number the company will pay. W