CVE-2026-73692: Authorization Bypass via Inverted Boolean in clonetasks Mass Action in Dolibarr ERP/CRM
Published Aug 18, 2026
·Updated
Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.
Affected Software
1 affected component
dolibarr Dolibarr ERP/CRM
Event History
Aug 18, 2026
CVE Published
via MITRE·01:39 PM
Rejected
via MITRE·01:39 PM
Data Sourced
via NVD·02:18 PM
Description
Rejected
via MITRE·03:34 PM
Frequently Asked Questions
1
Who is exposed to this vulnerability?
Authenticated users who have project creation permissions can exploit the issue. They can target private projects to which they do not have authorized access.
2
What does an attacker need to exploit it?
The attacker needs an authenticated account with project creation permissions and must submit a user-controlled projectid POST parameter through the clonetasks mass action. No user interaction is required.
3
What is the impact of successful exploitation?
Successful exploitation allows creation of task records in arbitrary private projects. The available information indicates an integrity impact, with no stated confidentiality or availability impact.