Authorization Bypass in Dolibarr via Clonetasks Mass Action

Executive Summary

Dolibarr has an authorization bypass flaw in the clonetasks feature. Authenticated users with project creation rights can clone tasks into private projects they should not access. This happens because a boolean condition in the code incorrectly checks private project membership, allowing attackers to manipulate a projectid parameter to create tasks in unauthorized private projects.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, inspect the Dolibarr installation for the affected file actions_massactions.inc.php. Check if the private project membership check uses an inverted condition like !in_array() instead of in_array(). Review server logs for unauthorized task cloning attempts or POST requests to the clonetasks endpoint with user-controlled projectid parameters.

Useful 0 Not Useful 0

Impact Analysis

If exploited, this flaw could let unauthorized users add tasks to private projects, potentially leaking sensitive data or disrupting project workflows. Attackers might manipulate task records to inject malicious content or disrupt operations in projects they should not access.

Useful 0 Not Useful 0

Mitigation Strategies

Apply the official patch from the Dolibarr commit 1730aa56675b31cfede895fdae55b673d887fb8f. Update the actions_massactions.inc.php file to correct the inverted boolean condition in the private project check. Ensure only authorized users can clone tasks into private projects by verifying proper permission checks.

Useful 0 Not Useful 0