From 05268dca37643bced1d8a8d0ce64750fd495ab9d Mon Sep 17 00:00:00 2001
From: Laurent Destailleur <eldy@users.sourceforge.net>
Date: Mon, 22 Jun 2026 02:29:53 +0200
Subject: [PATCH] Fix report by Bhuvaneswaran R, Security Engineer. Bad
 permission test on delete links

---
 htdocs/api/class/api_objectlinks.class.php | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/htdocs/api/class/api_objectlinks.class.php b/htdocs/api/class/api_objectlinks.class.php
index 0b53f632523..863b85e2aa9 100644
--- a/htdocs/api/class/api_objectlinks.class.php
+++ b/htdocs/api/class/api_objectlinks.class.php
@@ -219,10 +219,10 @@ class ObjectLinks extends DolibarrApi
 			if ($this->objectlink->targettype == 'conferenceorboothattendee') {
 				$tgttype = 'projet';
 			}
-			if (!DolibarrApiAccess::$user->hasRight(((string) $srctype), 'lire') && !DolibarrApiAccess::$user->hasRight(((string) $srctype), 'read')) {
+			if (!DolibarrApiAccess::$user->hasRight(((string) $srctype), 'creer') && !DolibarrApiAccess::$user->hasRight(((string) $srctype), 'write')) {
 				throw new RestException(403, 'denied access to the objectlinks sourcetype');
 			}
-			if (!DolibarrApiAccess::$user->hasRight(((string) $tgttype), 'lire') && !DolibarrApiAccess::$user->hasRight(((string) $tgttype), 'read')) {
+			if (!DolibarrApiAccess::$user->hasRight(((string) $tgttype), 'creer') && !DolibarrApiAccess::$user->hasRight(((string) $tgttype), 'write')) {
 				throw new RestException(403, 'denied access to the objectlinks targettype');
 			}
 		} else {