CVE-2026-77923 — Dolibarr 21.0.0 < 24.0.0 Authorization Bypass via clonetasks Mass Action
Dolibarr 21.0.0 before 24.0.0 contains an authorization bypass vulnerability caused by an inverted boolean condition in the private-project membership check within the clonetask…
Published: 2026-08-24 · CVSS: 5.3 · CVSS 4.0
Dolibarr 21.0.0 before 24.0.0 contains an authorization bypass vulnerability caused by an inverted boolean condition in the private-project membership check within the clonetasks mass action handler in htdocs/core/actions_massactions.inc.php. Authenticated users with project creation permission but without access to a target private project can exploit the flawed !in_array() check to clone tasks into unauthorized private projects.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7