CVE-2026-77923
Received Received - Intake

Authorization Bypass in Dolibarr via Clonetasks Mass Action

Publication date: 2026-08-24

Last updated on: 2026-08-24

Assigner: VulnCheck

Description
Dolibarr 21.0.0 before 24.0.0 contains an authorization bypass vulnerability caused by an inverted boolean condition in the private-project membership check within the clonetasks mass action handler in htdocs/core/actions_massactions.inc.php. Authenticated users with project creation permission but without access to a target private project can exploit the flawed !in_array() check to clone tasks into unauthorized private projects.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-24
Last Modified
2026-08-24
Generated
2026-08-25
AI Q&A
2026-08-24
EPSS Evaluated
N/A
NVD
CVE-2026-77923
EUVD
EUVD-2026-65087

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
dolibarr dolibarr to 24.0.0 (exc)
dolibarr dolibarr to 23.0.x (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-863 The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-77923 is an authorization bypass vulnerability in Dolibarr versions 21.0.0 through 24.0.0. It occurs in the clonetasks mass action handler due to an inverted boolean condition in the private-project membership check. Authenticated users with project creation rights but no access to a private project can exploit this flaw to clone tasks into unauthorized private projects.

Detection Guidance

To detect this vulnerability, check Dolibarr versions between 21.0.0 and 23.0.x. Verify if the file htdocs/core/actions_massactions.inc.php contains the flawed !in_array() check in the clonetasks mass action handler. Compare with the fixed version from the commit 1730aa56675b31cfede895fdae55b673d887fb8f.

Impact Analysis

This vulnerability allows unauthorized users to clone tasks into private projects they should not access. This could lead to data leakage, unauthorized modifications, or misuse of sensitive project information. The impact depends on the project's sensitivity and the data involved.

Compliance Impact

This vulnerability could violate compliance requirements by enabling unauthorized access to private project data. GDPR may be impacted if personal data is exposed, while HIPAA could be affected if protected health information is compromised. Organizations must ensure proper access controls to maintain regulatory compliance.

Mitigation Strategies

Immediately upgrade Dolibarr to version 24.0.0 or later to address the authorization bypass. If upgrading is not possible, review and correct the !in_array() check in htdocs/core/actions_massactions.inc.php to use in_array() for proper permission validation.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-77923. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart