Dolibarr Incorrect Authorization Vulnerability - CVE-2026-81729

Dolibarr before 23.0.4 authorizes REST API document deletion against the wrong permission. Documents::delete() in htdocs/api/class/api_documents.class.php calls dol_check_secure_access_document() with the mode argument read when handling DELETE /api/index.php/documents while the sibling builddoc() path passes write the correct mode for an operation that modifies stored data. An authenticated API user who holds only a read permission for a document-bearing module for example societe:lire o