Quick answers
- Is CVE-2026-89012 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-89012 being exploited in the wild.
- How severe is CVE-2026-89012?
- Medium severity, with a CVSS score of 6.5, published 11 September 2026.
- Which products and versions are affected?
- Dolibarr 24.0.0 before 24.0.1.
- Is there a fix for CVE-2026-89012?
- A patch was published on 2026-09-07: Fix released in version 24.0.1 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2026-89012 attacked?
- It is attacked over the network, in a web application.
- Am I affected by CVE-2026-89012?
- Check whether you run Dolibarr at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
The sqlfilters API parameter in Dolibarr 24.0.0 performs a case-sensitive denylist check against forbidden database field names, but the underlying database column resolution is case-insensitive, creating a bypass. An authenticated attacker can submit uppercase or mixed-case variants of protected field names (e.g., PASSWORD instead of password) to circumvent the denylist. By exploiting prefix-matching predicates as a boolean oracle, attackers can extract full password hashes for any user account. The vulnerability exists in htdocs/core/lib/functions.lib.php in the dolForgeSQLCriteriaCallback() function. The fix applies case-insensitive comparison to the denylist check by wrapping the operand in strtolower() before comparison.
Affected products
- Dolibarr Dolibarr 24.0.0 before 24.0.1
Timeline
- 2026-09-11: disclosed
- 2026-09-07: patched: Fix released in version 24.0.1