| Titre | Dolibarr ERP 23.0.3 Incorrect Permission Assignment |
|---|
| Description | Title: Payment Manipulation via Unenforced Role Permissions in TakePOS Module
Severity: High
CWE: CWE-862 (Missing Authorization) / CWE-284 (Improper Access Control)
OWASP: A01:2021 – Broken Access Control
summary
Payment Manipulation via Unenforced Role Permissions in TakePOS Module, In htdocs/takepos/invoice.php, the actions 'updateprice', 'updateqty', 'updatereduction' and 'deleteline' only display an error message when permission is denied instead of blocking execution. This allows any authenticated user with only basic TakePOS access to modify prices, quantities, discounts and delete order lines, enabling direct financial fraud in production environments.
A weak permission check in TakePOS allows a low-privileged user to manipulate product prices, add/delete order lines, and alter invoice totals before payment without being granted the required permissions. This enables internal payment fraud.
Affected Permissions
The following permissions exist but are not enforced:
Modifier les lignes de vente
Modifier les lignes de vente commandées
A user with only Utiliser le Point de Vente (TakePOS) can bypass both.
Steps to Reproduce
Create a user with only Utiliser le Point de Vente (TakePOS) enabled
Disable Modifier les lignes de vente and Modifier les lignes de vente commandées
Log in as that user and open TakePOS
Add products, freely modify prices, delete lines — no restriction enforced
Proceed to payment (Règlement) with manipulated totals
mpact
Price manipulation before payment processing
Unauthorized order line addition/deletion
Direct financial loss in production environments
Internal fraud by low-privileged cashier accounts
Vendor Acknowledgment:
The vulnerability was reported to Laurent Destailleur (Dolibarr lead developer) on June 21, 2026. The vendor acknowledged the issue and opened a GitHub issue requesting a contributor to process the fix
Vendor acknowledged the vulnerability and opened GitHub issue #38949:
https://github.com/Dolibarr/dolibarr/issues/38949
vendor credit requested: my name Abderrahmane Aksoum
|
|---|
| La source | ⚠️ https://github.com/Dolibarr/dolibarr/issues/38949 |
|---|
| Utilisateur | Abderrahmane Aksoum (UID 97571) |
|---|
| Soumission | 22/06/2026 23:16 (il y a 2 mois) |
|---|
| Modérer | 08/08/2026 18:27 (2 months later) |
|---|
| Statut | Accepté |
|---|
| Entrée VulDB | 387189 [Dolibarr ERP jusqu’à 23.0.3 TakePOS invoice.php fail élévation de privilèges] |
|---|
| Points | 20 |
|---|