The vulnerability resides in an unknown function within the htdocs/document.php file of Dolibarr’s CSP module, allowing an attacker to manipulate the function and cause the CSP protection mechanism to fail. This flaw can be triggered remotely and results in the bypass of protection intended to guard document handling operations. The weakness aligns with improper authorization controls (CWE‑693).

Dolibarr installations up to and including version 23.0.2 are affected. Version 24.0.0 contains a replacement function that eliminates the issue. The vulnerability impacts any system that serves document.php from the CSP module and allows remote manipulation of its behavior.

The CVSS score of 5.3 indicates medium severity, while the vulnerability is reachable from an external network, raising its practical impact. No EPSS score is available and the flaw is not listed in the CISA KEV catalog. An attacker can exploit this remote bypass to gain unauthorized access to document processing capabilities, representing a moderate to high risk in environments where such access could be abused.