Junglewise Threat Intelligence

CVE-2026-89013: Dolibarr authorization bypass in document storage endpoints

CVE-2026-89013 · Severity: high · CVSS 7.5 · Published 2026-09-11

Technologies: Dolibarr. Vendors: Dolibarr.

Executive brief

Dolibarr is an open-source business management software that stores invoices, contracts, and other sensitive documents. An unauthenticated attacker can bypass authorization controls and read arbitrary files—including application logs, database backups with password hashes, and documents belonging to other companies—by manipulating a single parameter in document requests.

Technical details

The vulnerability is an authorization bypass in htdocs/document.php and htdocs/viewimage.php that results from improper validation of the hashp parameter. An attacker can supply hashp=shared to skip token validation while satisfying the authorization condition, gaining unauthenticated access to the document storage endpoints. This allows retrieval of application logs, uploaded business documents, database backups containing password hashes, and files belonging to other multicompany entities. The fix, deployed in version 24.0.1, explicitly disallows the value 'shared' for the hashp parameter. No exploitation in the wild has been reported.

Affected products

  • Dolibarr Dolibarr 23.0.4 to 24.0.0 (fixed in 24.0.1)

Timeline

  • 2026-09-11: disclosed
  • 2026-09-07: patched: Fix released in version 24.0.1

References

Related threats