Description

A vulnerability has been found in Dolibarr ERP up to 23.0.3. Affected is the function fail of the file htdocs/takepos/invoice.php of the component TakePOS Module. Such manipulation leads to missing authorization. The attack may be performed from remote. The name of the patch is 8992ce8704da947b6abe7b65a6fe59aed736bb81. It is advisable to implement a patch to correct this issue.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.3",
  "pubDate": "2026-08-09T11:16:52.917Z",
  "pubdate": "2026-08-09T11:16:52.917Z",
  "executiveSummary": "A security vulnerability has been identified in the TakePOS Module of Dolibarr ERP up to version 23.0.3, specifically within the fail function located in htdocs/takepos/invoice.php. This security flaw stems from a missing authorization check, allowing unauthenticated or improperly authorized remote attackers to interact with sensitive invoice processing functionality.\nThe impact of this vulnerability involves the potential bypassing of access control enforcement, which can lead to unauthorized manipulation of transaction workflows within the Point of Sale (POS) environment. Because the attack vector is remote, malicious actors do not require physical access to the affected system to initiate exploitation.\nThe risk implications are significant for retail and enterprise environments relying on Dolibarr ERP for point-of-sale operations, as unauthorized state changes or transaction failures could disrupt business logic and compromise operational integrity.\nTo address this issue, administrators must apply the official patch identified by commit hash 8992ce8704da947b6abe7b65a6fe59aed736bb81 to restore proper authorization controls.",
  "technicalDetails": "The vulnerability resides in the TakePOS Module of Dolibarr ERP, specifically affecting the fail function implemented within the htdocs/takepos/invoice.php source code file. The root cause of the security defect is a lack of adequate access control validation and missing authorization checks prior to executing sensitive code logic.\nIn a secure implementation, HTTP requests destined for administrative or transactional endpoints within the POS module should rigorously validate user sessions, roles, and permissions to ensure the actor possesses the necessary privileges to execute the requested action. However, in the vulnerable version range up to 23.0.3, the htdocs/takepos/invoice.php script processes requests to the fail function without enforcing these critical authorization barriers.\nThe attack flow unfolds over a remote network vector. An unauthenticated or low-privileged remote attacker can craft a direct HTTP request targeting htdocs/takepos/invoice.php and invoke the vulnerable fail function. Because the application fails to verify whether the requester is authorized to execute this specific function, the server processes the input and performs the underlying operations.\nThis lack of privilege verification enables remote attackers to manipulate transaction states or trigger unintended operational outcomes within the TakePOS workflow. The vulnerability lowers the barrier for unauthorized state transitions, potentially allowing malicious external entities to interfere with point-of-sale records and accounting data.\nThe affected component is explicitly the TakePOS Module, impacting all Dolibarr ERP installations up to version 23.0.3. Remediation requires implementing the specific code modifications introduced in patch 8992ce8704da947b6abe7b65a6fe59aed736bb81, which introduces the necessary authorization guards into the vulnerable function."
}