CyberRota Analysis
AI-GeneratedDolibarr versions 21.0.0 through 24.0.0 are susceptible to an authorization bypass vulnerability that allows authenticated users with project creation permissions to clone tasks into private projects they should not have access to. This flaw arises from an incorrect boolean condition in the membership check within the mass action handler. Organizations using affected versions should prioritize patching to prevent unauthorized access to sensitive project data.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Dolibarr 21.0.0 before 24.0.0 contains an authorization bypass vulnerability caused by an inverted boolean condition in the private-project membership check within the clonetasks mass action handler in htdocs/core/actions_massactions.inc.php. Authenticated users with project creation permission but without access to a target private project can exploit the flawed !in_array() check to clone tasks into unauthorized private projects.
Related CVEs
Other vulnerabilities affecting the same vendor(s)