Dolibarr 24.0.2: what changes, and should you upgrade?

24.0.2 was released on 2 October 2026. It is a maintenance release: no new feature, but 260 fixes in the official changelog, 28 of them about security and access rights.

In one sentence: if you are on 24.0.0 or 24.0.1, move to 24.0.2. If you are on 23 or older, this is a major version change: go straight to 24.0.2, with the method of Upgrade Dolibarr without breaking anything.

Who should upgrade, and why

• You are on 24.0.0 or 24.0.1: yes, now. For security first (see below), and for two bugs that stop work:
  • with the unalterable log used since an older version, no invoice could be validated any more if its key had been left unencrypted in the database. 24.0.2 fixes this case: tested, validation works again and the key is encrypted at the first validated invoice;
  • in the Contacts tab of a proposal, an order or a project, the third-party search only showed lines (details here).
• You are on 23 or older: 24 changes things that matter (template variables, API login with a password disabled by default). Read the checklist before you start, and aim for 24.0.2, not 24.0.0 or 24.0.1.
• You use the official Docker image: since 24 October 2026, the 24.0.2 image runs on PHP 8.5. If one of your external modules does not support it yet, a 24.0.2-php8.2 variant exists. Everything is in Upgrade Dolibarr on Docker.

Security: 28 fixes

This is the real reason to upgrade. The changelog lists in particular:

• payment pages (VAT, salaries, supplier invoices, donations) that did not check the user’s rights;
• IDOR holes, where a logged-in user could read or change what did not belong to them: leaves, project comments, email templates;
• several REST API endpoints that did not check that a line belonged to the object, or ignored the restriction to the sales representative’s customers;
• a possible SSRF in the import of external calendars;
• public pages that accepted submissions while the feature was disabled, or showed the path of files on the server.

If your Dolibarr can be reached from the Internet, these fixes alone justify the upgrade.

The fixes you will notice day to day

Among the 260, these change life for many users:

• Buying price multiplied by 1000 when the thousand separator is a dot (#40657).
• Next date of recurring invoices shifted when the server is ahead of UTC (#41210).
• Prices by quantity and by level: enabling or disabling prices by quantity replaced the price of the level with the default price (#41197).
• Documents backup embedding all previous database dumps, and .zst backup written without compression (#40631, #40336).
• Professional ID pasted with its spaces and truncated, such as SIREN or SIRET (#39679).
• Sales journal keeping only the last deposit when an invoice used several (#40375).
• Draft receptions counted as received when validating a reception (#41002).
• Octopus invoice model: the VAT-by-rate table always showed 0%.

Seven fixes of this release were reported and written by Dolix: the “Private” field of email templates, the sender block over the logo on order PDFs, the default filter of the proposal list, the empty third-party list, the translation of product descriptions in PDFs, the linked objects in project PDFs, and the bank account of cloned various payments.

What comes next: the next 24.0.x

On 30 October 2026, 433 fix commits are already waiting in the 24.0 branch of the official repository (part of them concern the project’s tooling, not Dolibarr itself). They will ship with the next maintenance release, whose date is not announced. They include for example the treasury journal in cash accounting (a payment of several invoices rejected as “already recorded”), the empty TakePOS screen at first opening with cash control, and lines without price after a subtotal on PDFs.

This page will be updated when the next release comes out.

How this was established

• The figures come from the official 24.0.2 changelog: 260 lines, all of them fixes. The 28 security fixes are those whose title mentions access control, IDOR, SSRF, entity or unchecked rights.
• The unalterable log trap and the empty third-party list were tested on new 24.0.1 and 24.0.2 instances.
• The pending fix commits are counted in the 24.0 branch of the official repository, after the 24.0.2 tag.

Getting help

An upgrade, even a minor one, is played on your invoicing tool. The Safe upgrade package, at €390 excl. VAT, first rehearses it on a copy of your instance, checks your invoices, PDFs and modules, then switches. If you do not know where to start, the €90 diagnosis reviews it with you in one hour.