CVE-2026-19350: Missing Authorization in Dolibarr ERP
A vulnerability has been found in Dolibarr ERP up to 23.0.3. Affected is the function fail of the file htdocs/takepos/invoice.php of the component TakePOS Module. Such manipulation leads to missing authorization. The attack may be performed from remote. The name of the patch is 8992ce8704da947b6abe7b65a6fe59aed736bb81. It is advisable to implement a patch to correct this issue.
AI Analysis
Technical Summary
CVE-2026-19350 is a missing authorization vulnerability in Dolibarr ERP's TakePOS module affecting versions up to 23.0.3. The vulnerability resides in the fail function of the file htdocs/takepos/invoice.php. Exploitation can be performed remotely by an attacker with limited privileges, potentially leading to unauthorized actions impacting confidentiality, integrity, and availability. The vulnerability is classified under CWE-862. A patch exists identified by commit 8992ce8704da947b6abe7b65a6fe59aed736bb81, which should be applied to remediate the issue.
Potential Impact
The vulnerability allows an attacker with limited privileges to bypass authorization controls remotely, potentially leading to unauthorized access or actions within the TakePOS module of Dolibarr ERP. This can result in partial compromise of confidentiality, integrity, and availability of the affected system components.
Mitigation Recommendations
A patch identified by commit 8992ce8704da947b6abe7b65a6fe59aed736bb81 is available and should be applied to Dolibarr ERP installations up to version 23.0.3 to remediate this vulnerability. No vendor advisory content was provided to indicate otherwise, so applying the patch is advisable.
CVE-2026-19350: Missing Authorization in Dolibarr ERP
Description
A vulnerability has been found in Dolibarr ERP up to 23.0.3. Affected is the function fail of the file htdocs/takepos/invoice.php of the component TakePOS Module. Such manipulation leads to missing authorization. The attack may be performed from remote. The name of the patch is 8992ce8704da947b6abe7b65a6fe59aed736bb81. It is advisable to implement a patch to correct this issue.
CVSS v4.0
Score 5.3medium
Affected software
pkg:github/dolibarr/dolibarrRun on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2026-19350 is a missing authorization vulnerability in Dolibarr ERP's TakePOS module affecting versions up to 23.0.3. The vulnerability resides in the fail function of the file htdocs/takepos/invoice.php. Exploitation can be performed remotely by an attacker with limited privileges, potentially leading to unauthorized actions impacting confidentiality, integrity, and availability. The vulnerability is classified under CWE-862. A patch exists identified by commit 8992ce8704da947b6abe7b65a6fe59aed736bb81, which should be applied to remediate the issue.
Potential Impact
The vulnerability allows an attacker with limited privileges to bypass authorization controls remotely, potentially leading to unauthorized access or actions within the TakePOS module of Dolibarr ERP. This can result in partial compromise of confidentiality, integrity, and availability of the affected system components.
Mitigation Recommendations
A patch identified by commit 8992ce8704da947b6abe7b65a6fe59aed736bb81 is available and should be applied to Dolibarr ERP installations up to version 23.0.3 to remediate this vulnerability. No vendor advisory content was provided to indicate otherwise, so applying the patch is advisable.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- GHSA-67pw-8gc7-9qq9
- Osv Schema Version
- 1.4.0
- Aliases
- ["CVE-2026-19350"]
- Database Specific Severity
- MODERATE
- Cvss Version
- 3.1
- State
- PUBLISHED
Threat ID: 6a7891c3bf8831d539c85754
Added to database: 08/09/2026, 14:42:11 UTC
Last enriched: 08/09/2026, 14:43:13 UTC
Last updated: 09/25/2026, 01:47:41 UTC
Views: 128
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.