CVE-2026-77923: Dolibarr 21.0.0 < 24.0.0 Authorization Bypass via clonetasks Mass Action
Dolibarr 21.0.0 before 24.0.0 contains an authorization bypass vulnerability caused by an inverted boolean condition in the private-project membership check within the clonetasks mass action handler in htdocs/core/actionsmassactions.inc.php. Authenticated users with project creation permission but without access to a target private project can exploit the flawed !inarray() check to clone tasks into unauthorized private projects.
Affected Software
Event History
Frequently Asked Questions
Which users can exploit this issue?
An attacker must be authenticated and have permission to create projects. They do not need access to the target private project.
What access does exploitation provide?
Exploitation allows the user to clone tasks into private projects they are not authorized to access. The provided data identifies an integrity impact, but does not indicate confidentiality or availability impact.
Which versions should be remediated?
Dolibarr versions from 21.0.0 up to, but not including, 24.0.0 are affected. Version 24.0.0 includes the referenced fix.