Dolibarr < 24.0.0 - Authorization Bypass via hashp Parameter
CVE-2026-89013
Verified
Description
Dolibarr ERP/CRM versions 23.0.4 through 24.0.0 contain an authorization bypass vulnerability in document.php and viewimage.php. The public share-link feature forces NOLOGIN when hashp is present, but the value 'shared' skips token resolution while the override still fires for any non-empty hashp value. This bypass allows unauthenticated remote attackers to read arbitrary files from all Dolibarr managed directories including logs, SQL database backups, invoices, contracts, user vcards, and custom module sources.
Severity
High
CVSS Score
7.5
Exploit Probability
2%
Affected Product
dolibarr
Published Date
September 21, 2026
Template Author
dhiyaneshdk
CVE-2026-89013.yaml
7.5Score
CVSS Metrics
CVSS Vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
CVE ID:
cve-2026-89013
CWE ID:
cwe-863
References
https://github.com/Faceless0x7/CVE-2026-89013https://github.com/Dolibarr/dolibarr/commit/cd05688dbed8a4af6eef32faf4fc1e823a37bce9https://github.com/Dolibarr/dolibarr/commit/a8bc4a63e1b6356884abcd83c4a38954d9649b0bhttps://github.com/Dolibarr/dolibarr/commit/3bd8aa8b909e596d7dab4388d0466ec24e6ad191https://github.com/Dolibarr/dolibarr/releases/tag/24.0.1https://www.vulncheck.com/advisories/dolibarr-authorization-bypass-via-hashp-parameter-in-document-phphttps://previdian.com/CVE-2026-89013http://nvd.nist.gov/vuln/detail/CVE-2026-89013
Remediation Steps
Upgrade Dolibarr to version 24.0.1 or later.