Vulnerability · Published Aug 9, 2026 · Assigned by VulDB

CVE-2026-19350Dolibarr ERP TakePOS invoice.php fail authorization

Medium 6.3

In plain English

A medium-severity missing authorization in ERP from Dolibarr. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 17% of all known vulnerabilities).

Severity (CVSS 3.1)6.3Medium

Exploit odds (30 days)0.3%top 82.5% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

A vulnerability has been found in Dolibarr ERP up to 23.0.3. Affected is the function fail of the file htdocs/takepos/invoice.php of the component TakePOS Module. Such manipulation leads to missing authorization. The attack may be performed from remote. The name of the patch is 8992ce8704da947b6abe7b65a6fe59aed736bb81. It is advisable to implement a patch to correct this issue.

Affected products (as reported)

Vendor	Product	Versions
Dolibarr	ERP	23.0.023.0.123.0.223.0.3

Weakness: CWE-862, CWE-863 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:X/RL:O/RC:C

References

VDB-387189 | Dolibarr ERP TakePOS invoice.php fail authorization vdb-entry, technical-description
VDB-387189 | CTI Indicators (IOB, IOC, IOA) signature, permissions-required
CVE-2026-19350 | CVE Analysis and Report third-party-advisory
Submit #865736 | Dolibarr ERP 23.0.3 Incorrect Permission Assignment third-party-advisory
https://github.com/Dolibarr/dolibarr/issues/38949 issue-tracking
https://github.com/Dolibarr/dolibarr/pull/38999 issue-tracking, patch
https://github.com/Dolibarr/dolibarr/commit/8992ce8704da947b6abe7b65a6fe59aed736bb81 patch