CVE-2026-77923

MEDIUM 4.3

Dolibarr 21.0.0 < 24.0.0 Authorization Bypass via clonetasks Mass Action

CVSS Score

4.3

EPSS Score

0.0%

EPSS Percentile

0th

Dolibarr 21.0.0 before 24.0.0 contains an authorization bypass vulnerability caused by an inverted boolean condition in the private-project membership check within the clonetasks mass action handler in htdocs/core/actions_massactions.inc.php. Authenticated users with project creation permission but without access to a target private project can exploit the flawed !in_array() check to clone tasks into unauthorized private projects.

CWE	CWE-863
Vendor	dolibarr
Product	dolibarr
Published	Aug 24, 2026
Last Updated	Aug 24, 2026

Stay Ahead of the Next One

Get instant alerts for dolibarr dolibarr

Be the first to know when new medium vulnerabilities affecting dolibarr dolibarr are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

None

Affected Versions

Dolibarr / dolibarr

21.0.0 < 24.0.0

References

NVD ↗ CVE.org ↗ EPSS Data ↗

github.com: https://github.com/Dolibarr/dolibarr/releases/tag/24.0.0 github.com: https://github.com/Dolibarr/dolibarr/commit/1730aa56675b31cfede895fdae55b673d887fb8f vulncheck.com: https://www.vulncheck.com/advisories/dolibarr-authorization-bypass-via-clonetasks-mass-action

Credits

Pavel Kohout, Aisle Research