Authorization Bypass in Dolibarr ERP TakePOS Module
CVE-2026-19350

5.3MEDIUM

Key Information:

Vendor

Dolibarr

Status
Erp
Vendor
CVE Published:
9 August 2026

What is CVE-2026-19350?

A vulnerability in the TakePOS Module of Dolibarr ERP, specifically within the function fail of invoice.php, allows an attacker to bypass authorization controls. This can result in unauthorized access to functionalities intended only for authenticated users. The vulnerability affects several versions of Dolibarr ERP up to 23.0.3 and can be exploited remotely. It is strongly recommended to apply the available patch to rectify this issue and enhance system security.

Affected Version(s)

ERP 23.0.0

ERP 23.0.1

ERP 23.0.2

References

https://vuldb.com/vuln/387189
vdb-entrytechnical-description
https://vuldb.com/vuln/387189/cti
signaturepermissions-required
https://vuldb.com/cve/CVE-2026-19350
third-party-advisory

CVSS V4

Score:
5.3
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Abderrahmane Aksoum (VulDB User)
.