Authorization Bypass in Dolibarr Affects Users' Project Security

CVE-2026-77923

What is CVE-2026-77923?

An authorization bypass vulnerability exists in Dolibarr ERP & CRM versions prior to 24.0.0. This issue arises from a flawed boolean condition in the membership check for private-projects. By exploiting the flawed verification method in the clonetasks mass action handler, authenticated users with project creation permissions can clone tasks into private projects to which they shouldn't have access, potentially leading to unauthorized disclosures and security breaches.

References