CVE-2026-89013— Dolibarr 23.0.4 < 24.0.1 Authorization Bypass via hashp Parameter in document.php
Quick assessment
Affected
Dolibarr Dolibarr
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
Dolibarr 23.0.4（24.0.1 之前的版本）存在一个授权绕过漏洞，允许未认证的攻击者通过向文档存储端点提供一个特制的 参数值，从而读取任意文件。攻击者可以通过发送包含 的请求来跳过令牌验证，同时满足 和 中的授权条件。由此，攻击者可以访问应用程序日志、上传的商业文档、包含密码哈希值的数据库备份，以及属于其他多公司实体的文件。
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-89013
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Dolibarr 23.0.4 < 24.0.1 Authorization Bypass via hashp Parameter in document.php
Source: CVE Program / CVE List V5
Vulnerability Description
Dolibarr 23.0.4 before 24.0.1 ontains an authorization bypass vulnerability that allows unauthenticated attackers to read arbitrary files through the document storage endpoints by supplying a crafted hashp parameter value. Attackers can send a request with hashp=shared to skip token validation while satisfying the authorization condition in htdocs/document.php and htdocs/viewimage.php, gaining access to application logs, uploaded business documents, database backups containing password hashes, and files belonging to other multicompany entities.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
授权机制不正确
Source: CVE Program / CVE List V5
Affected Products
II. Public POCs for CVE-2026-89013
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-89013
请登录查看更多情报信息。
Patches & Fixes for CVE-2026-89013 (1)
Vendor Advisories for CVE-2026-89013 (1)
Vendor Pages for CVE-2026-89013 (1)
-
🔗 Release 24.0.1 · Dolibarr/dolibarr · GitHub release-notes
IV. Related Vulnerabilities
Same product: Dolibarr
-
CVE-2026-89012
Dolibarr 24.0.0 < 24.0.1 SQL Filter Denylist Bypass via sqlf -
CVE-2026-85401
Dolibarr Legacy File Manager config.inc.php access control -
CVE-2026-82633
Dolibarr 10.0.0 before 24.0.0 Missing Authorization on REST -
CVE-2026-81730
Dolibarr 9.0.0 through 23.0.4 Path Traversal via EmailCollec -
CVE-2026-81728
Dolibarr before 24.0.0 SQL Injection via the CSV and XLSX Im
Same vendor: Dolibarr
-
CVE-2026-89012
Dolibarr 24.0.0 < 24.0.1 SQL Filter Denylist Bypass via sqlf -
CVE-2026-82633
Dolibarr 10.0.0 before 24.0.0 Missing Authorization on REST -
CVE-2026-81730
Dolibarr 9.0.0 through 23.0.4 Path Traversal via EmailCollec -
CVE-2026-81728
Dolibarr before 24.0.0 SQL Injection via the CSV and XLSX Im -
CVE-2026-81729
Dolibarr before 23.0.4 Incorrect Authorization on REST API D
Same weakness: CWE-863
-
CVE-2026-89151
Forgejo 16.0.4前受限API令牌权限越界 -
CVE-2026-78134
strongSwan 4.5.0-6.0.7 EAP插件访问控制缺陷 -
CVE-2026-81905
Concrete CMS below 9.5.3 does not enforce validation-hash ty -
CVE-2026-75624
IBM App Connect Enterprise is vulnerable to privilege escala -
CVE-2026-85025
Langflow is vulnerable to arbitrary code execution due to mu
V. Comments for CVE-2026-89013
No comments yet