CVE-2026-77923

Name of the Vulnerable Software and Affected Versions Dolibarr versions 21.0.0 through 23.x

Description An authorization bypass exists due to an inverted boolean condition in the private-project membership check. This occurs within the clonetasks mass action handler located in htdocs/core/actions massactions.inc.php. Authenticated users who possess project creation permissions, but lack access to a specific private project, can exploit the flawed !in array() check to clone tasks into unauthorized private projects.

Recommendations Update to version 24.0.0 or later.