CVE-2026-77923

Medium

Description

Dolibarr 21.0.0 before 24.0.0 contains an authorization bypass vulnerability caused by an inverted boolean condition in the private-project membership check within the clonetasks mass action handler in htdocs/core/actions_massactions.inc.php. Authenticated users with project creation permission but without access to a target private project can exploit the flawed !in_array() check to clone tasks into unauthorized private projects.

SeverityMedium

CVSS4.3

Exploit probability—

ProductDolibarr Erp\/crm

PublishedAug 24, 2026

First seenAug 24, 2026

Weakness typeCWE-863Incorrect authorization

How to fix

Update

dolibarr dolibarr_erp\/crm24.0.0 or later

Patches

github.com/Dolibarr/dolibarr/commit/1730aa56675b31cfede895fdae55b673d887fb8f

Vendor advisories

github.com/Dolibarr/dolibarr/releases/tag/24.0.0

Affected products

Product	Affected versions	Fixed in
dolibarr dolibarr_erp\/crm	21.0.0 ≤ v < 24.0.0	24.0.0

Check your version

Choose the product and enter the version you run to see whether it falls in the affected range.

In the Intelligence 360 plan

Attack Surface Management

See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.