Description

Dolibarr 21.0.0 before 24.0.0 contains an authorization bypass vulnerability caused by an inverted boolean condition in the private-project membership check within the clonetasks mass action handler in htdocs/core/actions_massactions.inc.php. Authenticated users with project creation permission but without access to a target private project can exploit the flawed !in_array() check to clone tasks into unauthorized private projects.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "4.3",
  "pubDate": "2026-08-24T20:17:21.560Z",
  "pubdate": "2026-08-24T20:17:21.560Z",
  "executiveSummary": "Dolibarr versions 21.0.0 prior to 24.0.0 are affected by an authorization bypass vulnerability involving the private-project membership verification logic.\nThe vulnerability resides within the clonetasks mass action handler implemented in htdocs/core/actions_massactions.inc.php, where an inverted boolean condition incorrectly validates user access rights.\nAn authenticated user possessing project creation permissions—yet lacking explicit membership or access rights to a specific target private project—can exploit this flaw to bypass security boundaries.\nBy manipulating task cloning requests through the mass action handler, attackers can successfully clone tasks into unauthorized private projects, leading to unauthorized data manipulation and a breach of project segregation boundaries within the application.\nThe risk implications include unauthorized modification of project structures and potential information exposure across isolated project workspaces.\nSuccessful exploitation requires authenticated access to the application, specifically holding standard project creation privileges while targeting restricted private projects.",
  "technicalDetails": "The vulnerability is caused by a logic defect in the private-project membership check implemented within the clonetasks mass action handler located at htdocs/core/actions_massactions.inc.php.\nThe root cause of the authorization bypass is an inverted boolean condition utilizing a flawed !in_array() check when evaluating whether the executing user possesses valid permissions or membership status regarding the destination private project.\nDue to this logical inversion, the access control mechanism evaluates to true when access should be denied, and vice-versa, effectively granting unauthorized users the ability to perform restricted actions.\nThe affected component is the mass action handler script htdocs/core/actions_massactions.inc.php, specifically the code block responsible for processing the clonetasks action.\nAffected software versions include Dolibarr 21.0.0 up to, but not including, version 24.0.0.\nAuthentication requirements dictate that the attacker must possess a valid, authenticated user session within the Dolibarr instance.\nPrivilege requirements mandate that the user must hold project creation permissions, though they are explicitly prohibited from accessing the specific target private project.\nNetwork exposure encompasses any standard HTTP/HTTPS interface through which authenticated users interact with the Dolibarr web application.\nThe exploitation flow proceeds step-by-step as follows: First, the authenticated user navigates to the task management interface and selects the mass action handler designed to clone tasks. Second, the user initiates a clonetasks request directed toward a target private project for which they lack membership or explicit authorization. Third, the application processes the request via htdocs/core/actions_massactions.inc.php, invoking the flawed !in_array() validation check. Fourth, because the boolean condition is inverted, the check fails to block the operation, incorrectly validating the user's authorization status against the restricted private project. Finally, the server executes the task cloning routine, injecting the tasks into the unauthorized private project.\nPost-exploitation impact includes the unauthorized insertion of tasks into restricted project spaces, compromising data integrity, confidentiality, and segregation boundaries between independent private projects within the application."
}