CVE-2026-77923

MediumCVSS 4.3/10Last modified Oct 12, 2026

Description

Dolibarr 21.0.0 before 24.0.0 contains an authorization bypass vulnerability caused by an inverted boolean condition in the private-project membership check within the clonetasks mass action handler in htdocs/core/actions_massactions.inc.php. Authenticated users with project creation permission but without access to a target private project can exploit the flawed !in_array() check to clone tasks into unauthorized private projects.

Metrics

CVSS 3.1 4.3/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Weakness enumeration

CWE-863

Affected software

Vendor	Product	Versions
Dolibarr	dolibarr	>= 21.0.0, < 24.0.0

References

https://github.com/Dolibarr/dolibarr/commit/1730aa56675b31cfede895fdae55b673d887fb8fPatch
https://github.com/Dolibarr/dolibarr/releases/tag/24.0.0Product, Release Notes
https://www.vulncheck.com/advisories/dolibarr-authorization-bypass-via-clonetasks-mass-actionPatch, Release Notes, Third Party Advisory

Timeline

Published: Aug 24, 2026
Last modified: Oct 12, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-779268.8Aix-DB 1.2.4 contains a remote code execution vulnerability that allows authenticated non-admin users to run operating system commands throu CVE-2026-779276.5ClipBucket v5 before 5.5.3-#182 contains a blind SQL injection vulnerability that allows authenticated users to extract arbitrary data from CVE-2026-779286.5ClipBucket v5 before 5.5.3-#182 contains a blind SQL injection vulnerability that allows authenticated users to extract arbitrary database c CVE-2026-779298.8ClipBucket v5 before 5.5.3-#182 contains a file upload vulnerability that allows authenticated users to achieve remote code execution by upl CVE-2026-779309.8EvoScientist 0.1.0 before 0.2.5 contains an approval bypass vulnerability that allows attackers to run host shell commands by delegating the CVE-2026-779318.8MoviePilot through 3.1.5 contains a command injection vulnerability that allows attackers to execute arbitrary OS commands by embedding mali CVE-2026-779329.8DB-GPT through 0.8.2 contains an unauthenticated remote code execution vulnerability because the /api/v1/chat/react-agent endpoint relies on CVE-2026-779339.8DB-GPT through 0.8.2 contains a hardcoded credentials vulnerability in its default docker-compose.yml that sets a static MYSQL_ROOT_PASSWORD CVE-2026-779348.8Coze Studio before 0.5.0 contains an insecure default configuration that allows any registered user to execute commands by running workflow CVE-2026-779358.3Coze Studio through 0.5.1 contains an insecure direct object reference vulnerability in workflow.go that allows authenticated users to acces CVE-2026-779369.8Letta through 0.16.8 ships a compose.yaml that does not enable LETTA_SERVER_SECURE, so the password middleware is never added and all API ro CVE-2026-779378.1Letta through 0.16.8 contains an authentication bypass vulnerability that allows API callers to impersonate other users by supplying a self-