# CVE-2026-89013: Dolibarr authorization bypass in document storage endpoints

Source: https://junglewise.ai/threats/cve-2026-89013-dolibarr-authorization-bypass-in-document-storage-endpoints  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-11. Updated: 2026-09-26  
License: CC BY 4.0 with a link back

CVE-2026-89013 · Severity: high · CVSS 7.5 · Published 2026-09-11

Dolibarr is an open-source business management software that stores invoices, contracts, and other sensitive documents. An unauthenticated attacker can bypass authorization controls and read arbitrary files—including application logs, database backups with password hashes, and documents belonging to other companies—by manipulating a single parameter in document requests.

Technologies: [Dolibarr](https://junglewise.ai/threats/technologies/dolibarr). Vendors: [Dolibarr](https://junglewise.ai/threats/vendors/dolibarr).

## Quick answers

**Is CVE-2026-89013 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-89013 being exploited in the wild.

**How severe is CVE-2026-89013?** High severity, with a CVSS score of 7.5, published 11 September 2026.

**Which products and versions are affected?** Dolibarr 23.0.4 to 24.0.0 (fixed in 24.0.1).

**Is there a fix for CVE-2026-89013?** A patch was published on 2026-09-07: Fix released in version 24.0.1 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-89013 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-89013?** Check whether you run Dolibarr at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability is an authorization bypass in htdocs/document.php and htdocs/viewimage.php that results from improper validation of the hashp parameter. An attacker can supply hashp=shared to skip token validation while satisfying the authorization condition, gaining unauthenticated access to the document storage endpoints. This allows retrieval of application logs, uploaded business documents, database backups containing password hashes, and files belonging to other multicompany entities. The fix, deployed in version 24.0.1, explicitly disallows the value 'shared' for the hashp parameter. No exploitation in the wild has been reported.

## Affected products

- Dolibarr Dolibarr 23.0.4 to 24.0.0 (fixed in 24.0.1)

## Timeline

- 2026-09-11: disclosed
- 2026-09-07: patched: Fix released in version 24.0.1

## References

- [https://github.com/Dolibarr/dolibarr/commit/cd05688dbed8a4af6eef32faf4fc1e823a37bce9](https://github.com/Dolibarr/dolibarr/commit/cd05688dbed8a4af6eef32faf4fc1e823a37bce9)
- [https://github.com/Dolibarr/dolibarr/releases/tag/24.0.1](https://github.com/Dolibarr/dolibarr/releases/tag/24.0.1)

## Related threats

- [Dolibarr authorization bypass in expense report payments API](https://junglewise.ai/threats/cve-2026-125754-dolibarr-20-0-0-through-23-0-4-and-24-x-before-24-0-2-contains)
- [Dolibarr CSP mechanism bypass in document.php](https://junglewise.ai/threats/cve-2026-112361-a-vulnerability-has-been-found-in-dolibarr-up-to-23-0-2-the)
- [Dolibarr case-sensitive denylist bypass in sqlfilters API](https://junglewise.ai/threats/cve-2026-89012-dolibarr-case-sensitive-denylist-bypass-in-sqlfilters-api)
- [Dolibarr Legacy File Manager improper access control](https://junglewise.ai/threats/cve-2026-85401-dolibarr-legacy-file-manager-improper-access-control)
- [Dolibarr authorization bypass in Users::getGroups REST API](https://junglewise.ai/threats/cve-2026-82633-dolibarr-authorization-bypass-in-users-getgroups-rest-api)