A vulnerability in the Dolibarr payments API allows authenticated attackers to perform unauthorized deletion of financial records, threatening data availability and integrity.

This issue is characterized as an incorrect authorization (CWE-863) flaw within the payments REST API. An authenticated attacker can target the delete endpoint to remove payment records, despite lacking the required permissions to perform such operations.

Successful exploitation poses a severe risk to the financial record-keeping capabilities of the application. An attacker could delete payment history, which would lead to significant operational disruption, audit failures, and potential financial data loss. With a CVSS score of 8.1, the impact on data integrity and availability is considered high.

Immediate Action: Upgrade to Dolibarr version 24.0.0 or later, which contains the corrected authorization logic for the payments API.

Proactive Monitoring: Monitor access logs for unauthorized attempts to access or delete payment resources, particularly from user accounts with limited permissions.

Compensating Controls: Use a Web Application Firewall (WAF) to restrict access to sensitive API endpoints, ensuring only authorized roles can invoke deletion methods.

Public Exploit Available: No

All administrators must apply the security update to version 24.0.0 as soon as possible. Restricting access to the payments API and ensuring that only authorized personnel have high-level privileges will help mitigate the risk until the patch is deployed.