The vulnerability stems from an inverted boolean in Dolibarr’s clonetasks mass action that allows an authenticated user with project‑creation rights to set the authorization flag for private projects they should not access. By supplying a user‑controlled project ID in a POST request, the attacker can create tasks within any private project, bypassing the intended access control and enabling unauthorized data manipulation or disclosure.

Dolibarr ERP/CRM installations that include the clonetasks mass action functionality are affected. The issue applies to any deployment where users have permission to create projects and where the provided patch has not been applied. No specific product version is listed, so all current releases containing the vulnerable code are potentially impacted.

The CVSS score of 5.3 indicates moderate severity, and the vulnerability is not listed in CISA’s KEV catalog. EPSS information is not available, so the likelihood of exploitation cannot be quantified. Exploitation requires an authenticated user with project‑creation privileges and is carried out via a standard web application POST request, making the attack path straightforward and low in complexity.