Executive brief
Dolibarr is an open-source business management software that stores invoices, contracts, and other sensitive documents. An unauthenticated attacker can bypass authorization controls and read arbitrary files—including application logs, database backups with password hashes, and documents belonging to other companies—by manipulating a single parameter in document requests.
Technical details
The vulnerability is an authorization bypass in htdocs/document.php and htdocs/viewimage.php that results from improper validation of the hashp parameter. An attacker can supply hashp=shared to skip token validation while satisfying the authorization condition, gaining unauthenticated access to the document storage endpoints. This allows retrieval of application logs, uploaded business documents, database backups containing password hashes, and files belonging to other multicompany entities. The fix, deployed in version 24.0.1, explicitly disallows the value 'shared' for the hashp parameter. No exploitation in the wild has been reported.
Affected products
- Dolibarr Dolibarr 23.0.4 to 24.0.0 (fixed in 24.0.1)
Timeline
- 2026-09-11: disclosed
- 2026-09-07: patched: Fix released in version 24.0.1