Description
A vulnerability has been found in Dolibarr ERP up to 23.0.3. Affected is the function fail of the file htdocs/takepos/invoice.php of the component TakePOS Module. Such manipulation leads to missing authorization. The attack may be performed from remote. The name of the patch is 8992ce8704da947b6abe7b65a6fe59aed736bb81. It is advisable to implement a patch to correct this issue.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Dolibarr | ERP | 23.0.0, 23.0.1, 23.0.2, 23.0.3 | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu Pro 16.04 LTS | dolibarr | No fix yet | — |
References
- VDB-387189 | Dolibarr ERP TakePOS invoice.php fail authorization vdb-entry technical-description
- VDB-387189 | CTI Indicators (IOB, IOC, IOA) signature permissions-required
- CVE-2026-19350 | CVE Analysis and Report third-party-advisory
- Submit #865736 | Dolibarr ERP 23.0.3 Incorrect Permission Assignment third-party-advisory
- https://github.com/Dolibarr/dolibarr/issues/38949 issue-tracking
- https://github.com/Dolibarr/dolibarr/pull/38999 issue-tracking patch
- https://github.com/Dolibarr/dolibarr/commit/8992ce8704da947b6abe7b65a6fe59aed736bb81 patch