Dolibarr versions prior to 24.0.0 contain a flaw in the clonetasks mass action handler where an inverted boolean condition causes an improper check of private‑project membership. Exploiting this inverted !in_array() test allows an authenticated user who can create projects, but who is not a member of the target private project, to clone tasks into that private project, thereby gaining unauthorized access to its information. The weakness is classified as CWE-863.

The vulnerability affects Dolibarr product versions 21.0.0 through the 23.x releases, before the 24.0.0 fix. It is present in the core file htdocs/core/actions_massactions.inc.php and enables users to clone tasks into projects they should not be able to see.

The CVSS score of 5.3 indicates a medium severity. EPSS data is not available and the vulnerability is not listed in CISA’s KEV catalog. Exploitation requires an authenticated session with project‑creation rights and the target project must be private. Attackers would simply use the normal interface to trigger the mass‑action; no additional privileges or system access are required beyond those already possessed.