CVE-2026-19350: Dolibarr ERP Auth Bypass Vulnerability

CVE-2026-19350 Overview

CVE-2026-19350 is a missing authorization vulnerability [CWE-862] in Dolibarr ERP versions up to 23.0.3. The flaw resides in the fail function within htdocs/takepos/invoice.php, part of the TakePOS module. Authenticated remote users can invoke line-modification actions without the required takeposeditlines permission. Actions such as deleting a line, updating quantity, updating price, or applying discounts execute without proper authorization checks. Upstream maintainers merged commit 8992ce8704da947b6abe7b65a6fe59aed736bb81 to enforce permission gating on these operations.

Critical Impact
Low-privileged cashier accounts can modify existing invoice lines, altering quantities, prices, and discounts on TakePOS invoices without holding the editlines permission.

Affected Products

Dolibarr ERP versions up to and including 23.0.3
Dolibarr TakePOS module (htdocs/takepos/invoice.php)
Deployments exposing the TakePOS interface to authenticated users without the editlines right

Discovery Timeline

2026-08-09 - CVE-2026-19350 published to NVD
2026-08-12 - Last updated in NVD database

Technical Details for CVE-2026-19350

Vulnerability Analysis

The vulnerability affects the action-dispatch logic in htdocs/takepos/invoice.php. Dolibarr's TakePOS module differentiates between two permission scopes: takepos.run for baseline point-of-sale usage and takepos.editlines for modifying existing invoice lines. Prior to the patch, the dispatcher accepted actions including deleteline, updateqty, updateprice, updatereduction, and update_reduction_global without verifying that the caller held the editlines right.

Any authenticated cashier who could reach the TakePOS interface could submit these action parameters directly and mutate invoice line data. The impact includes tampered pricing, unauthorized discounts, and removal of billable lines, which produces both fraud risk and audit-trail inconsistencies inside the ERP.

Root Cause

The root cause is missing authorization enforcement on state-changing actions. The controller code trusted the presence of an authenticated session and the takepos.run right, then routed line-modifying actions to their handlers without an additional permission check. This is a classic broken access control pattern where server-side authorization does not match the intended UI-level restriction.

Attack Vector

An attacker requires network access to the Dolibarr instance and valid low-privilege credentials that grant TakePOS access. The attacker submits a crafted HTTP request to invoice.php with an action parameter set to one of the vulnerable operations plus the target line identifier. No user interaction from a higher-privileged account is required.

php

$reshook = $hookmanager->executeHooks('doActions', $parameters, $invoice, $action);
if ($reshook < 0) setEventMessages($hookmanager->error, $hookmanager->errors, 'errors');

// Patch: Enforce the "edit lines" permission on every action that modifies
// an existing line (delete, quantity, price, discount). Adding a line, a
// free zone, or a note is gated by the "run" permission elsewhere and must
// stay available to a plain cashier (#38949).
if (in_array($action, array('deleteline', 'updateqty', 'updateprice', 'updatereduction', 'update_reduction_global'))
    && !$user->hasRight('takepos', 'editlines')) {
    dol_htmloutput_errors($langs->trans("NotEnoughPermissions", "TakePos"), null, 1);
    $action = '';
}

if (empty($reshook)) {
    // Action to record a payment on a TakePOS invoice
    if ($action == 'valid' && $user->hasRight('facture', 'creer')) {

Source: Dolibarr GitHub Commit 8992ce8

Detection Methods for CVE-2026-19350

Indicators of Compromise

HTTP POST requests to /htdocs/takepos/invoice.php containing action=deleteline, action=updateqty, action=updateprice, action=updatereduction, or action=update_reduction_global originating from cashier accounts.
Invoice audit records showing line deletions or price changes performed by users who do not hold the takepos.editlines right.
Repeated line modifications on open TakePOS invoices from a single session outside normal operating patterns.

Detection Strategies

Correlate Dolibarr application logs with the effective user permission set at the time of the modification. Any modification action executed by a user lacking editlines on an unpatched instance is evidence of exploitation.
Alert on unexpected price deltas or reduction values applied to invoices before payment recording (action=valid).
Baseline typical cashier behavior and flag deviations such as line deletions immediately preceding invoice validation.

Monitoring Recommendations

Enable web server access logging on the Dolibarr front-end and forward it to a centralized log platform for query and retention.
Monitor commits and pull requests on the Dolibarr repository for related follow-up fixes referenced by Issue #38949 and Pull Request #38999.
Track database-level changes to invoice line tables and alert on modifications outside a defined change window.

How to Mitigate CVE-2026-19350

Immediate Actions Required

Apply the upstream patch 8992ce8704da947b6abe7b65a6fe59aed736bb81 or upgrade to a Dolibarr release that includes the fix.
Audit which users hold takepos.run without takepos.editlines and confirm this separation matches intended business policy.
Review recent TakePOS invoice modifications for anomalous deletions, quantity changes, or discount applications.

Patch Information

The fix adds a server-side permission check inside htdocs/takepos/invoice.php that rejects deleteline, updateqty, updateprice, updatereduction, and update_reduction_global when the current user lacks the takepos.editlines right. See the Dolibarr commit, Issue #38949, and Pull Request #38999.

Workarounds

Restrict TakePOS module access to trusted staff only until the patch is deployed.
Place the Dolibarr instance behind a reverse proxy or WAF rule that blocks requests to invoice.php with the vulnerable action values from users outside a defined allowlist.
Temporarily grant takepos.editlines only to supervisors and require them to complete line-modification actions until patched.

bash

# Apply the upstream fix from within a Dolibarr working tree
cd /path/to/dolibarr
git fetch origin
git cherry-pick 8992ce8704da947b6abe7b65a6fe59aed736bb81

# Verify the guard is present in the TakePOS controller
grep -n "takepos', 'editlines" htdocs/takepos/invoice.php