Dolibarr ERP EUVD-2026-54918

Exploitation requires an active, authenticated Dolibarr session with at least the takepos.run permission granting access to the TakePOS module. The vulnerability only applies to users who lack the takepos.editlines permission - if all TakePOS users already hold that permission, the authorization gap has no exploitable effect, though the missing check remains a design flaw. The attack is confined entirely to the TakePOS module; Dolibarr deployments that do not use TakePOS are not exposed. Unauthenticated network attackers cannot exploit this flaw. Exploitation is limited to five specific invoice actions: deleteline, updateqty, updateprice, updatereduction, and update_reduction_global. Adding new lines, free zones, or notes is unaffected by the fix, as those operations are gated separately by the run permission.

The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N with VC:L/VI:L/VA:L) accurately captures the threat profile: network-accessible, low attack complexity, but constrained by the requirement for a valid authenticated session and limited to partial integrity and availability impacts within the POS module. There is no CISA KEV listing and no identified POC, indicating exploitation is not currently widespread. EPSS data was not provided; given the authentication prerequisite and narrow scope, opportunistic mass exploitation is unlikely. The integrity impact is the most operationally significant dimension - price manipulation or line deletion in a live retail or hospitality POS environment carries direct financial fraud potential, meaning even a mid-sized municipal IT team in kielce managing a Dolibarr-based point-of-sale deployment should treat this as a moderate priority review item, especially if cashier accounts are shared or poorly supervised. The CVSS 5.3 score is consistent with real-world risk: not critical infrastructure-level, but financially material in affected deployments.

An authenticated Dolibarr user holding only the base takepos.run permission - such as a cashier without line-editing rights - crafts a direct HTTP POST to the TakePOS invoice.php endpoint with an action parameter of updateprice or deleteline, targeting an active invoice. Because the pre-patch code does not validate the editlines permission for these actions, the request is processed and the invoice is modified without authorization. No public proof-of-concept code has been identified, but the attack path requires only knowledge of the endpoint and a valid session cookie, making it trivially replicable by any authenticated insider.