CVE-2026-73692: Authorization Bypass via Inverted Boolean in clonetasks Mass Action in Dolibarr ERP/CRM
Dolibarr contains an authorization bypass vulnerability in the clonetasks mass action that allows authenticated users with project creation permissions to clone tasks into private projects they are not authorized to access. An inverted boolean condition in the private-project membership check within actionsmassactions.inc.php causes the authorization flag to be set for unauthorized users, allowing attackers to supply a user-controlled projectid POST parameter to create task records in any private project.
Affected Software
Event History
Frequently Asked Questions
Who is exposed to this vulnerability?
Authenticated users who have project creation permissions can exploit the issue. They can target private projects to which they do not have authorized access.
What does an attacker need to exploit it?
The attacker needs an authenticated account with project creation permissions and must submit a user-controlled projectid POST parameter through the clonetasks mass action. No user interaction is required.
What is the impact of successful exploitation?
Successful exploitation allows creation of task records in arbitrary private projects. The available information indicates an integrity impact, with no stated confidentiality or availability impact.