A vulnerability has been found in Dolibarr ERP up to 23.0.3. (CVE-2026-19350)
A vulnerability exists in Dolibarr ERP up to version 23.0.3 in the TakePOS module, specifically in the fail function of htdocs/takepos/invoice.php. This flaw allows missing authorization, potentially enabling remote attackers with limited privileges to perform unauthorized actions. The issue is identified as CWE-862 (Missing Authorization). A patch identified by commit 8992ce8704da947b6abe7b65a6fe59aed736bb81 is recommended to address this vulnerability. The CVSS 3.1 base score is 6.3, indicating a medium severity level.
AI Analysis
Technical Summary
CVE-2026-19350 is a missing authorization vulnerability in Dolibarr ERP's TakePOS module affecting versions up to 23.0.3. The vulnerability resides in the fail function of the file htdocs/takepos/invoice.php. Exploitation can be performed remotely by an attacker with limited privileges, potentially leading to unauthorized actions impacting confidentiality, integrity, and availability. The vulnerability is classified under CWE-862. A patch exists identified by commit 8992ce8704da947b6abe7b65a6fe59aed736bb81, which should be applied to remediate the issue.
Potential Impact
The vulnerability allows an attacker with limited privileges to bypass authorization controls remotely, potentially leading to unauthorized access or actions within the TakePOS module of Dolibarr ERP. This can result in partial compromise of confidentiality, integrity, and availability of the affected system components.
Mitigation Recommendations
A patch identified by commit 8992ce8704da947b6abe7b65a6fe59aed736bb81 is available and should be applied to Dolibarr ERP installations up to version 23.0.3 to remediate this vulnerability. No vendor advisory content was provided to indicate otherwise, so applying the patch is advisable.
A vulnerability has been found in Dolibarr ERP up to 23.0.3. (CVE-2026-19350)
Description
A vulnerability exists in Dolibarr ERP up to version 23.0.3 in the TakePOS module, specifically in the fail function of htdocs/takepos/invoice.php. This flaw allows missing authorization, potentially enabling remote attackers with limited privileges to perform unauthorized actions. The issue is identified as CWE-862 (Missing Authorization). A patch identified by commit 8992ce8704da947b6abe7b65a6fe59aed736bb81 is recommended to address this vulnerability. The CVSS 3.1 base score is 6.3, indicating a medium severity level.
CVSS v3.1
Score 6.3medium
Affected software
pkg:github/dolibarr/dolibarrRun on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2026-19350 is a missing authorization vulnerability in Dolibarr ERP's TakePOS module affecting versions up to 23.0.3. The vulnerability resides in the fail function of the file htdocs/takepos/invoice.php. Exploitation can be performed remotely by an attacker with limited privileges, potentially leading to unauthorized actions impacting confidentiality, integrity, and availability. The vulnerability is classified under CWE-862. A patch exists identified by commit 8992ce8704da947b6abe7b65a6fe59aed736bb81, which should be applied to remediate the issue.
Potential Impact
The vulnerability allows an attacker with limited privileges to bypass authorization controls remotely, potentially leading to unauthorized access or actions within the TakePOS module of Dolibarr ERP. This can result in partial compromise of confidentiality, integrity, and availability of the affected system components.
Mitigation Recommendations
A patch identified by commit 8992ce8704da947b6abe7b65a6fe59aed736bb81 is available and should be applied to Dolibarr ERP installations up to version 23.0.3 to remediate this vulnerability. No vendor advisory content was provided to indicate otherwise, so applying the patch is advisable.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- GHSA-67pw-8gc7-9qq9
- Osv Schema Version
- 1.4.0
- Aliases
- ["CVE-2026-19350"]
- Ecosystems
- []
- Database Specific Severity
- MODERATE
- Cvss Version
- 3.1
Threat ID: 6a7891c3bf8831d539c85754
Added to database: 08/09/2026, 14:42:11 UTC
Last enriched: 08/09/2026, 14:43:13 UTC
Last updated: 08/10/2026, 05:40:59 UTC
Views: 8
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.