CVE-2026-19350— Dolibarr ERP TakePOS invoice.php fail authorization
Quick assessment
Affected
Dolibarr ERP
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
Dolibarr ERP是Dolibarr基金会的一款信息化产品。 Dolibarr ERP 23.0.3及之前版本存在授权问题漏洞，该漏洞源于TakePOS Module组件的htdocs/takepos/invoice.php文件中fail函数存在授权缺失问题，可能导致远程攻击。
Possible ATT&CK Techniques 1 AI
T1078 · Valid Accounts
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-19350
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Dolibarr ERP TakePOS invoice.php fail authorization
Source: CVE Program / CVE List V5
Vulnerability Description
A vulnerability has been found in Dolibarr ERP up to 23.0.3. Affected is the function fail of the file htdocs/takepos/invoice.php of the component TakePOS Module. Such manipulation leads to missing authorization. The attack may be performed from remote. The name of the patch is 8992ce8704da947b6abe7b65a6fe59aed736bb81. It is advisable to implement a patch to correct this issue.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
Source: CVE Program / CVE List V5
Vulnerability Type
授权机制缺失
Source: CVE Program / CVE List V5
Vulnerability Title
Dolibarr ERP 授权问题漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Dolibarr ERP是Dolibarr基金会的一款信息化产品。 Dolibarr ERP 23.0.3及之前版本存在授权问题漏洞，该漏洞源于TakePOS Module组件的htdocs/takepos/invoice.php文件中fail函数存在授权缺失问题，可能导致远程攻击。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
II. Public POCs for CVE-2026-19350
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-19350
请登录查看更多情报信息。
Patches & Fixes for CVE-2026-19350 (2)
Vendor Advisories for CVE-2026-19350 (1)
-
Submit #865736: Dolibarr ERP 23.0.3 Incorrect Permission Assignment third-party-advisory
Security Blog Posts for CVE-2026-19350 (1)
Other References for CVE-2026-19350 (2)
-
-
CVE-2026-19350 in ERP third-party-advisory
IV. Related Vulnerabilities
Same product: ERP
-
CVE-2026-78160
Dolibarr ERP User Notes note.php authorization -
CVE-2026-4175
Aureus ERP Chatter Message content-text-entry.blade.php cros -
CVE-2025-14089
Himool ERP AdminActionViewSet update_account improper author -
CVE-2025-2706
Digiwin ERP UploadAjaxAPI.ashx unrestricted upload -
CVE-2025-2705
Digiwin ERP FileUploadApi.ashx DoWebUpload unrestricted uplo
Same vendor: Dolibarr
-
CVE-2026-89013
Dolibarr 23.0.4 < 24.0.1 Authorization Bypass via hashp Para -
CVE-2026-89012
Dolibarr 24.0.0 < 24.0.1 SQL Filter Denylist Bypass via sqlf -
CVE-2026-82633
Dolibarr 10.0.0 before 24.0.0 Missing Authorization on REST -
CVE-2026-81730
Dolibarr 9.0.0 through 23.0.4 Path Traversal via EmailCollec -
CVE-2026-81728
Dolibarr before 24.0.0 SQL Injection via the CSV and XLSX Im
Same weakness: CWE-862
-
CVE-2026-11601
WPCafe <= 3.0.19 - Missing Authorization to Unauthenticated -
CVE-2026-94505
Nelio Content <= 4.5.0 - Missing Authorization to Authentica -
CVE-2026-101923
Photo Reviews for WooCommerce <= 1.2.30 - Missing Authorizat -
CVE-2026-97337
Simple Membership <= 4.8.3 - Missing Authorization to Unauth -
CVE-2026-91108
Alt Text AI <= 1.10.41 - Missing Authorization to Authentica
V. Comments for CVE-2026-19350
No comments yet