CVE-2026-89013

CVE-2026-89013 is an authorization bypass vulnerability (CWE-863) in Dolibarr ERP/CRM that allows unauthenticated attackers to read arbitrary files from the server. An attacker sends a request to htdocs/document.php or htdocs/viewimage.php with the hashp parameter set to "shared", which skips token validation while still satisfying the authorization condition. Successful exploitation grants access to application logs, uploaded business documents, database backups containing password hashes, and files belonging to other multicompany entities. All deployments running the affected version range (23.0.4 before 24.0.1) are impacted, particularly self-hosted instances reachable from the internet. No public proof-of-concept is known, the flaw is not in CISA KEV, and no confirmed in-the-wild exploitation has been reported.

What to do: Upgrade to Dolibarr 24.0.1 or later, which fixes the bypass. As an interim mitigation, restrict or filter requests to document.php and viewimage.php at the reverse proxy/WAF layer, and review access logs for requests carrying hashp=shared. Because exposed database backups contain password hashes, consider rotating credentials if sensitive backups were reachable.