CVE-2026-77923 - Dolibarr 21.0.0 24.0.0 Authorization Bypass via clonetasks Mass Action
Brief
CVE ID : CVE-2026-77923
Published : Aug. 24, 2026, 8:17 p. m.
- 54 minutes ago
Description : Dolibarr 21.
- 0 before 24.
- 0 contains an authorization bypass vulnerability caused by an inverted boolean condition in the private-project membership check within the clonetasks mass action handler in htdocs/core/actions_massactions. inc. php. Authenticated users with project creation permission but without access to a target private project can exploit the flawed !
in_array() check to clone tasks into unauthorized private projects.
Severity: 5.3
- MEDIUM
Visit the link for more details, such as CVSS details, affected products, timeline, and more...