Search
Find a vulnerability
Search criteria
4 vulnerabilities found for ERP by Dolibarr
CVE-2026-78160 (GCVE-0-2026-78160)
Vulnerability from nvd – Published: 2026-08-24 00:30 – Updated: 2026-08-24 14:59 X_Open Source
VLAI
EPSS
VEX
Title
Dolibarr ERP User Notes note.php authorization
Summary
A vulnerability has been found in Dolibarr ERP up to 18.0.10/22.0.5/23.0.3. This issue affects some unknown processing of the file /user/note.php of the component User Notes Handler. The manipulation of the argument ID leads to authorization bypass. The attack can be initiated remotely. Upgrading to version 23.0.4 and 24.0.0 is capable of addressing this issue. The identifier of the patch is 9b5229ef3a9b58d00252d327936b022fb739f149. Upgrading the affected component is advised.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-24 14:59 UTC
Assigner
References
8 references
| URL | Tags |
|---|---|
| https://vuldb.com/vuln/394542 | vdb-entrytechnical-description |
| https://vuldb.com/vuln/394542/cti | signaturepermissions-required |
| https://vuldb.com/cve/CVE-2026-78160 | third-party-advisory |
| https://vuldb.com/submit/883067 | third-party-advisory |
| https://github.com/Dolibarr/dolibarr/issues/39063 | issue-tracking |
| https://github.com/Dolibarr/dolibarr/pull/39123 | issue-trackingpatch |
| https://github.com/Dolibarr/dolibarr/commit/9b522… | patch |
| https://github.com/Dolibarr/dolibarr/releases/tag… | patch |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Dolibarr | ERP |
Affected:
18.0.0
Affected: 18.0.1 Affected: 18.0.2 Affected: 18.0.3 Affected: 18.0.4 Affected: 18.0.5 Affected: 18.0.6 Affected: 18.0.7 Affected: 18.0.8 Affected: 18.0.9 Affected: 18.0.10 Affected: 22.0.0 Affected: 22.0.1 Affected: 22.0.2 Affected: 22.0.3 Affected: 22.0.4 Affected: 22.0.5 Affected: 23.0.0 Affected: 23.0.1 Affected: 23.0.2 Affected: 23.0.3 Unaffected: 23.0.4 Unaffected: 24.0.0 cpe:2.3:a:dolibarr:erp:*:*:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-78160",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-24T14:59:16.334698Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-24T14:59:25.089Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:a:dolibarr:erp:*:*:*:*:*:*:*:*"
],
"modules": [
"User Notes Handler"
],
"product": "ERP",
"vendor": "Dolibarr",
"versions": [
{
"status": "affected",
"version": "18.0.0"
},
{
"status": "affected",
"version": "18.0.1"
},
{
"status": "affected",
"version": "18.0.2"
},
{
"status": "affected",
"version": "18.0.3"
},
{
"status": "affected",
"version": "18.0.4"
},
{
"status": "affected",
"version": "18.0.5"
},
{
"status": "affected",
"version": "18.0.6"
},
{
"status": "affected",
"version": "18.0.7"
},
{
"status": "affected",
"version": "18.0.8"
},
{
"status": "affected",
"version": "18.0.9"
},
{
"status": "affected",
"version": "18.0.10"
},
{
"status": "affected",
"version": "22.0.0"
},
{
"status": "affected",
"version": "22.0.1"
},
{
"status": "affected",
"version": "22.0.2"
},
{
"status": "affected",
"version": "22.0.3"
},
{
"status": "affected",
"version": "22.0.4"
},
{
"status": "affected",
"version": "22.0.5"
},
{
"status": "affected",
"version": "23.0.0"
},
{
"status": "affected",
"version": "23.0.1"
},
{
"status": "affected",
"version": "23.0.2"
},
{
"status": "affected",
"version": "23.0.3"
},
{
"status": "unaffected",
"version": "23.0.4"
},
{
"status": "unaffected",
"version": "24.0.0"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "Abderrahmane Aksoum (VulDB User)"
}
],
"descriptions": [
{
"lang": "en",
"value": "A vulnerability has been found in Dolibarr ERP up to 18.0.10/22.0.5/23.0.3. This issue affects some unknown processing of the file /user/note.php of the component User Notes Handler. The manipulation of the argument ID leads to authorization bypass. The attack can be initiated remotely. Upgrading to version 23.0.4 and 24.0.0 is capable of addressing this issue. The identifier of the patch is 9b5229ef3a9b58d00252d327936b022fb739f149. Upgrading the affected component is advised."
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P",
"version": "4.0"
}
},
{
"cvssV3_1": {
"baseScore": 6.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C",
"version": "3.1"
}
},
{
"cvssV3_0": {
"baseScore": 6.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C",
"version": "3.0"
}
},
{
"cvssV2_0": {
"baseScore": 6.5,
"vectorString": "AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:OF/RC:C",
"version": "2.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-639",
"description": "Authorization Bypass",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-285",
"description": "Improper Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-24T00:30:10.986Z",
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB"
},
"references": [
{
"name": "VDB-394542 | Dolibarr ERP User Notes note.php authorization",
"tags": [
"vdb-entry",
"technical-description"
],
"url": "https://vuldb.com/vuln/394542"
},
{
"name": "VDB-394542 | CTI Indicators (IOB, IOC, IOA)",
"tags": [
"signature",
"permissions-required"
],
"url": "https://vuldb.com/vuln/394542/cti"
},
{
"name": "CVE-2026-78160 | CVE Analysis and Report",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/cve/CVE-2026-78160"
},
{
"name": "Submit #883067 | dolibarr erp 18.0 User with Self-Edit Rights Can Write to Any Profile(Root + All )",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/submit/883067"
},
{
"tags": [
"issue-tracking"
],
"url": "https://github.com/Dolibarr/dolibarr/issues/39063"
},
{
"tags": [
"issue-tracking",
"patch"
],
"url": "https://github.com/Dolibarr/dolibarr/pull/39123"
},
{
"tags": [
"patch"
],
"url": "https://github.com/Dolibarr/dolibarr/commit/9b5229ef3a9b58d00252d327936b022fb739f149"
},
{
"tags": [
"patch"
],
"url": "https://github.com/Dolibarr/dolibarr/releases/tag/23.0.4"
}
],
"tags": [
"x_open-source"
],
"timeline": [
{
"lang": "en",
"time": "2026-08-23T00:00:00.000Z",
"value": "Advisory disclosed"
},
{
"lang": "en",
"time": "2026-08-23T02:00:00.000Z",
"value": "VulDB entry created"
},
{
"lang": "en",
"time": "2026-08-23T13:48:59.000Z",
"value": "VulDB entry last update"
}
],
"title": "Dolibarr ERP User Notes note.php authorization",
"x_generator": [
"VulDB PVTS v202608"
]
}
},
"cveMetadata": {
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"assignerShortName": "VulDB",
"cveId": "CVE-2026-78160",
"datePublished": "2026-08-24T00:30:10.986Z",
"dateReserved": "2026-08-23T11:43:54.013Z",
"dateUpdated": "2026-08-24T14:59:25.089Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-19350 (GCVE-0-2026-19350)
Vulnerability from nvd – Published: 2026-08-09 10:45 – Updated: 2026-08-10 13:46 X_Open Source
VLAI
EPSS
VEX
Title
Dolibarr ERP TakePOS invoice.php fail authorization
Summary
A vulnerability has been found in Dolibarr ERP up to 23.0.3. Affected is the function fail of the file htdocs/takepos/invoice.php of the component TakePOS Module. Such manipulation leads to missing authorization. The attack may be performed from remote. The name of the patch is 8992ce8704da947b6abe7b65a6fe59aed736bb81. It is advisable to implement a patch to correct this issue.
Severity
SSVC
Exploitation: poc
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-10 13:46 UTC
Assigner
References
7 references
| URL | Tags |
|---|---|
| https://vuldb.com/vuln/387189 | vdb-entrytechnical-description |
| https://vuldb.com/vuln/387189/cti | signaturepermissions-required |
| https://vuldb.com/cve/CVE-2026-19350 | third-party-advisory |
| https://vuldb.com/submit/865736 | third-party-advisory |
| https://github.com/Dolibarr/dolibarr/issues/38949 | issue-tracking |
| https://github.com/Dolibarr/dolibarr/pull/38999 | issue-trackingpatch |
| https://github.com/Dolibarr/dolibarr/commit/8992c… | patch |
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-19350",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-10T13:46:05.316773Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-10T13:46:25.980Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://github.com/Dolibarr/dolibarr/issues/38949"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:a:dolibarr:erp:*:*:*:*:*:*:*:*"
],
"modules": [
"TakePOS Module"
],
"product": "ERP",
"vendor": "Dolibarr",
"versions": [
{
"status": "affected",
"version": "23.0.0"
},
{
"status": "affected",
"version": "23.0.1"
},
{
"status": "affected",
"version": "23.0.2"
},
{
"status": "affected",
"version": "23.0.3"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "Abderrahmane Aksoum (VulDB User)"
}
],
"descriptions": [
{
"lang": "en",
"value": "A vulnerability has been found in Dolibarr ERP up to 23.0.3. Affected is the function fail of the file htdocs/takepos/invoice.php of the component TakePOS Module. Such manipulation leads to missing authorization. The attack may be performed from remote. The name of the patch is 8992ce8704da947b6abe7b65a6fe59aed736bb81. It is advisable to implement a patch to correct this issue."
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X",
"version": "4.0"
}
},
{
"cvssV3_1": {
"baseScore": 6.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:X/RL:O/RC:C",
"version": "3.1"
}
},
{
"cvssV3_0": {
"baseScore": 6.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:X/RL:O/RC:C",
"version": "3.0"
}
},
{
"cvssV2_0": {
"baseScore": 6.5,
"vectorString": "AV:N/AC:L/Au:S/C:P/I:P/A:P/E:ND/RL:OF/RC:C",
"version": "2.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-862",
"description": "Missing Authorization",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-863",
"description": "Incorrect Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-09T10:45:10.818Z",
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB"
},
"references": [
{
"name": "VDB-387189 | Dolibarr ERP TakePOS invoice.php fail authorization",
"tags": [
"vdb-entry",
"technical-description"
],
"url": "https://vuldb.com/vuln/387189"
},
{
"name": "VDB-387189 | CTI Indicators (IOB, IOC, IOA)",
"tags": [
"signature",
"permissions-required"
],
"url": "https://vuldb.com/vuln/387189/cti"
},
{
"name": "CVE-2026-19350 | CVE Analysis and Report",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/cve/CVE-2026-19350"
},
{
"name": "Submit #865736 | Dolibarr ERP 23.0.3 Incorrect Permission Assignment",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/submit/865736"
},
{
"tags": [
"issue-tracking"
],
"url": "https://github.com/Dolibarr/dolibarr/issues/38949"
},
{
"tags": [
"issue-tracking",
"patch"
],
"url": "https://github.com/Dolibarr/dolibarr/pull/38999"
},
{
"tags": [
"patch"
],
"url": "https://github.com/Dolibarr/dolibarr/commit/8992ce8704da947b6abe7b65a6fe59aed736bb81"
}
],
"tags": [
"x_open-source"
],
"timeline": [
{
"lang": "en",
"time": "2026-08-08T00:00:00.000Z",
"value": "Advisory disclosed"
},
{
"lang": "en",
"time": "2026-08-08T02:00:00.000Z",
"value": "VulDB entry created"
},
{
"lang": "en",
"time": "2026-08-08T18:32:29.000Z",
"value": "VulDB entry last update"
}
],
"title": "Dolibarr ERP TakePOS invoice.php fail authorization",
"x_generator": [
"VulDB PVTS v202608"
]
}
},
"cveMetadata": {
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"assignerShortName": "VulDB",
"cveId": "CVE-2026-19350",
"datePublished": "2026-08-09T10:45:10.818Z",
"dateReserved": "2026-08-08T16:27:24.385Z",
"dateUpdated": "2026-08-10T13:46:25.980Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-78160 (GCVE-0-2026-78160)
Vulnerability from cvelistv5 – Published: 2026-08-24 00:30 – Updated: 2026-08-24 14:59 X_Open Source
VLAI
EPSS
VEX
Title
Dolibarr ERP User Notes note.php authorization
Summary
A vulnerability has been found in Dolibarr ERP up to 18.0.10/22.0.5/23.0.3. This issue affects some unknown processing of the file /user/note.php of the component User Notes Handler. The manipulation of the argument ID leads to authorization bypass. The attack can be initiated remotely. Upgrading to version 23.0.4 and 24.0.0 is capable of addressing this issue. The identifier of the patch is 9b5229ef3a9b58d00252d327936b022fb739f149. Upgrading the affected component is advised.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-24 14:59 UTC
Assigner
References
8 references
| URL | Tags |
|---|---|
| https://vuldb.com/vuln/394542 | vdb-entrytechnical-description |
| https://vuldb.com/vuln/394542/cti | signaturepermissions-required |
| https://vuldb.com/cve/CVE-2026-78160 | third-party-advisory |
| https://vuldb.com/submit/883067 | third-party-advisory |
| https://github.com/Dolibarr/dolibarr/issues/39063 | issue-tracking |
| https://github.com/Dolibarr/dolibarr/pull/39123 | issue-trackingpatch |
| https://github.com/Dolibarr/dolibarr/commit/9b522… | patch |
| https://github.com/Dolibarr/dolibarr/releases/tag… | patch |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Dolibarr | ERP |
Affected:
18.0.0
Affected: 18.0.1 Affected: 18.0.2 Affected: 18.0.3 Affected: 18.0.4 Affected: 18.0.5 Affected: 18.0.6 Affected: 18.0.7 Affected: 18.0.8 Affected: 18.0.9 Affected: 18.0.10 Affected: 22.0.0 Affected: 22.0.1 Affected: 22.0.2 Affected: 22.0.3 Affected: 22.0.4 Affected: 22.0.5 Affected: 23.0.0 Affected: 23.0.1 Affected: 23.0.2 Affected: 23.0.3 Unaffected: 23.0.4 Unaffected: 24.0.0 cpe:2.3:a:dolibarr:erp:*:*:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-78160",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-24T14:59:16.334698Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-24T14:59:25.089Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:a:dolibarr:erp:*:*:*:*:*:*:*:*"
],
"modules": [
"User Notes Handler"
],
"product": "ERP",
"vendor": "Dolibarr",
"versions": [
{
"status": "affected",
"version": "18.0.0"
},
{
"status": "affected",
"version": "18.0.1"
},
{
"status": "affected",
"version": "18.0.2"
},
{
"status": "affected",
"version": "18.0.3"
},
{
"status": "affected",
"version": "18.0.4"
},
{
"status": "affected",
"version": "18.0.5"
},
{
"status": "affected",
"version": "18.0.6"
},
{
"status": "affected",
"version": "18.0.7"
},
{
"status": "affected",
"version": "18.0.8"
},
{
"status": "affected",
"version": "18.0.9"
},
{
"status": "affected",
"version": "18.0.10"
},
{
"status": "affected",
"version": "22.0.0"
},
{
"status": "affected",
"version": "22.0.1"
},
{
"status": "affected",
"version": "22.0.2"
},
{
"status": "affected",
"version": "22.0.3"
},
{
"status": "affected",
"version": "22.0.4"
},
{
"status": "affected",
"version": "22.0.5"
},
{
"status": "affected",
"version": "23.0.0"
},
{
"status": "affected",
"version": "23.0.1"
},
{
"status": "affected",
"version": "23.0.2"
},
{
"status": "affected",
"version": "23.0.3"
},
{
"status": "unaffected",
"version": "23.0.4"
},
{
"status": "unaffected",
"version": "24.0.0"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "Abderrahmane Aksoum (VulDB User)"
}
],
"descriptions": [
{
"lang": "en",
"value": "A vulnerability has been found in Dolibarr ERP up to 18.0.10/22.0.5/23.0.3. This issue affects some unknown processing of the file /user/note.php of the component User Notes Handler. The manipulation of the argument ID leads to authorization bypass. The attack can be initiated remotely. Upgrading to version 23.0.4 and 24.0.0 is capable of addressing this issue. The identifier of the patch is 9b5229ef3a9b58d00252d327936b022fb739f149. Upgrading the affected component is advised."
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P",
"version": "4.0"
}
},
{
"cvssV3_1": {
"baseScore": 6.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C",
"version": "3.1"
}
},
{
"cvssV3_0": {
"baseScore": 6.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C",
"version": "3.0"
}
},
{
"cvssV2_0": {
"baseScore": 6.5,
"vectorString": "AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:OF/RC:C",
"version": "2.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-639",
"description": "Authorization Bypass",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-285",
"description": "Improper Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-24T00:30:10.986Z",
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB"
},
"references": [
{
"name": "VDB-394542 | Dolibarr ERP User Notes note.php authorization",
"tags": [
"vdb-entry",
"technical-description"
],
"url": "https://vuldb.com/vuln/394542"
},
{
"name": "VDB-394542 | CTI Indicators (IOB, IOC, IOA)",
"tags": [
"signature",
"permissions-required"
],
"url": "https://vuldb.com/vuln/394542/cti"
},
{
"name": "CVE-2026-78160 | CVE Analysis and Report",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/cve/CVE-2026-78160"
},
{
"name": "Submit #883067 | dolibarr erp 18.0 User with Self-Edit Rights Can Write to Any Profile(Root + All )",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/submit/883067"
},
{
"tags": [
"issue-tracking"
],
"url": "https://github.com/Dolibarr/dolibarr/issues/39063"
},
{
"tags": [
"issue-tracking",
"patch"
],
"url": "https://github.com/Dolibarr/dolibarr/pull/39123"
},
{
"tags": [
"patch"
],
"url": "https://github.com/Dolibarr/dolibarr/commit/9b5229ef3a9b58d00252d327936b022fb739f149"
},
{
"tags": [
"patch"
],
"url": "https://github.com/Dolibarr/dolibarr/releases/tag/23.0.4"
}
],
"tags": [
"x_open-source"
],
"timeline": [
{
"lang": "en",
"time": "2026-08-23T00:00:00.000Z",
"value": "Advisory disclosed"
},
{
"lang": "en",
"time": "2026-08-23T02:00:00.000Z",
"value": "VulDB entry created"
},
{
"lang": "en",
"time": "2026-08-23T13:48:59.000Z",
"value": "VulDB entry last update"
}
],
"title": "Dolibarr ERP User Notes note.php authorization",
"x_generator": [
"VulDB PVTS v202608"
]
}
},
"cveMetadata": {
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"assignerShortName": "VulDB",
"cveId": "CVE-2026-78160",
"datePublished": "2026-08-24T00:30:10.986Z",
"dateReserved": "2026-08-23T11:43:54.013Z",
"dateUpdated": "2026-08-24T14:59:25.089Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-19350 (GCVE-0-2026-19350)
Vulnerability from cvelistv5 – Published: 2026-08-09 10:45 – Updated: 2026-08-10 13:46 X_Open Source
VLAI
EPSS
VEX
Title
Dolibarr ERP TakePOS invoice.php fail authorization
Summary
A vulnerability has been found in Dolibarr ERP up to 23.0.3. Affected is the function fail of the file htdocs/takepos/invoice.php of the component TakePOS Module. Such manipulation leads to missing authorization. The attack may be performed from remote. The name of the patch is 8992ce8704da947b6abe7b65a6fe59aed736bb81. It is advisable to implement a patch to correct this issue.
Severity
SSVC
Exploitation: poc
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-10 13:46 UTC
Assigner
References
7 references
| URL | Tags |
|---|---|
| https://vuldb.com/vuln/387189 | vdb-entrytechnical-description |
| https://vuldb.com/vuln/387189/cti | signaturepermissions-required |
| https://vuldb.com/cve/CVE-2026-19350 | third-party-advisory |
| https://vuldb.com/submit/865736 | third-party-advisory |
| https://github.com/Dolibarr/dolibarr/issues/38949 | issue-tracking |
| https://github.com/Dolibarr/dolibarr/pull/38999 | issue-trackingpatch |
| https://github.com/Dolibarr/dolibarr/commit/8992c… | patch |
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-19350",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-10T13:46:05.316773Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-10T13:46:25.980Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://github.com/Dolibarr/dolibarr/issues/38949"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:a:dolibarr:erp:*:*:*:*:*:*:*:*"
],
"modules": [
"TakePOS Module"
],
"product": "ERP",
"vendor": "Dolibarr",
"versions": [
{
"status": "affected",
"version": "23.0.0"
},
{
"status": "affected",
"version": "23.0.1"
},
{
"status": "affected",
"version": "23.0.2"
},
{
"status": "affected",
"version": "23.0.3"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "Abderrahmane Aksoum (VulDB User)"
}
],
"descriptions": [
{
"lang": "en",
"value": "A vulnerability has been found in Dolibarr ERP up to 23.0.3. Affected is the function fail of the file htdocs/takepos/invoice.php of the component TakePOS Module. Such manipulation leads to missing authorization. The attack may be performed from remote. The name of the patch is 8992ce8704da947b6abe7b65a6fe59aed736bb81. It is advisable to implement a patch to correct this issue."
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X",
"version": "4.0"
}
},
{
"cvssV3_1": {
"baseScore": 6.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:X/RL:O/RC:C",
"version": "3.1"
}
},
{
"cvssV3_0": {
"baseScore": 6.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:X/RL:O/RC:C",
"version": "3.0"
}
},
{
"cvssV2_0": {
"baseScore": 6.5,
"vectorString": "AV:N/AC:L/Au:S/C:P/I:P/A:P/E:ND/RL:OF/RC:C",
"version": "2.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-862",
"description": "Missing Authorization",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-863",
"description": "Incorrect Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-09T10:45:10.818Z",
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB"
},
"references": [
{
"name": "VDB-387189 | Dolibarr ERP TakePOS invoice.php fail authorization",
"tags": [
"vdb-entry",
"technical-description"
],
"url": "https://vuldb.com/vuln/387189"
},
{
"name": "VDB-387189 | CTI Indicators (IOB, IOC, IOA)",
"tags": [
"signature",
"permissions-required"
],
"url": "https://vuldb.com/vuln/387189/cti"
},
{
"name": "CVE-2026-19350 | CVE Analysis and Report",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/cve/CVE-2026-19350"
},
{
"name": "Submit #865736 | Dolibarr ERP 23.0.3 Incorrect Permission Assignment",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/submit/865736"
},
{
"tags": [
"issue-tracking"
],
"url": "https://github.com/Dolibarr/dolibarr/issues/38949"
},
{
"tags": [
"issue-tracking",
"patch"
],
"url": "https://github.com/Dolibarr/dolibarr/pull/38999"
},
{
"tags": [
"patch"
],
"url": "https://github.com/Dolibarr/dolibarr/commit/8992ce8704da947b6abe7b65a6fe59aed736bb81"
}
],
"tags": [
"x_open-source"
],
"timeline": [
{
"lang": "en",
"time": "2026-08-08T00:00:00.000Z",
"value": "Advisory disclosed"
},
{
"lang": "en",
"time": "2026-08-08T02:00:00.000Z",
"value": "VulDB entry created"
},
{
"lang": "en",
"time": "2026-08-08T18:32:29.000Z",
"value": "VulDB entry last update"
}
],
"title": "Dolibarr ERP TakePOS invoice.php fail authorization",
"x_generator": [
"VulDB PVTS v202608"
]
}
},
"cveMetadata": {
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"assignerShortName": "VulDB",
"cveId": "CVE-2026-19350",
"datePublished": "2026-08-09T10:45:10.818Z",
"dateReserved": "2026-08-08T16:27:24.385Z",
"dateUpdated": "2026-08-10T13:46:25.980Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}