CVE-2026-19350
Received Received - Intake

Missing Authorization in Dolibarr ERP TakePOS Module

Publication date: 2026-08-09

Last updated on: 2026-08-09

Assigner: VulDB

Description
A vulnerability has been found in Dolibarr ERP up to 23.0.3. Affected is the function fail of the file htdocs/takepos/invoice.php of the component TakePOS Module. Such manipulation leads to missing authorization. The attack may be performed from remote. The name of the patch is 8992ce8704da947b6abe7b65a6fe59aed736bb81. It is advisable to implement a patch to correct this issue.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-09
Last Modified
2026-08-09
Generated
2026-08-09
AI Q&A
2026-08-09
EPSS Evaluated
N/A
NVD
CVE-2026-19350
EUVD
EUVD-2026-54918

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
dolibarr dolibarr to 23.0.3 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-862 The product does not perform an authorization check when an actor attempts to access a resource or perform an action.
CWE-863 The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is a permission bypass in Dolibarr ERP's TakePOS module up to version 23.0.3. It allows users with only the 'takepos.run' permission to perform restricted invoice line actions like adding free-text lines, changing prices, deleting lines, and applying discounts before payment. The issue occurs because certain line-editing actions did not enforce the required 'editlines' permission server-side.

Detection Guidance

To detect this vulnerability, check if your Dolibarr ERP version is up to 23.0.3 or earlier. Verify if the TakePOS module is installed and if the patch 8992ce8704da947b6abe7b65a6fe59aed736bb81 is missing. Inspect the htdocs/takepos/invoice.php file for missing authorization checks on line-editing actions.

Impact Analysis

This vulnerability could allow unauthorized users to manipulate invoice details, leading to financial fraud or incorrect billing. Attackers could alter prices, delete items, or add unauthorized charges before payment processing, potentially causing financial losses or compliance violations.

Compliance Impact

This vulnerability could lead to non-compliance with data integrity and financial reporting requirements in GDPR, HIPAA, and other regulations. Unauthorized invoice modifications may violate audit trails, financial record accuracy, and data protection principles, potentially resulting in legal penalties or loss of certification.

Mitigation Strategies

Apply the patch 8992ce8704da947b6abe7b65a6fe59aed736bb81 to enforce editlines permission checks on all invoice line-editing actions. Ensure the editlines permission is enabled by default for the TakePOS module. Review user permissions to confirm only authorized users can modify invoice lines.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-19350. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart