CVE-2026-89037
Deferred Deferred - Pending Action

Dolibarr REST API Document Access Bypass

Publication date: 2026-11-13

Last updated on: 2026-11-13

Assigner: VulnCheck

Description
Dolibarr before 24.0.2 contains an insecure direct object reference vulnerability in the REST Documents API for the ticket module that allows authenticated API users to access ticket attachments belonging to other companies by omitting a company-scope check that is only applied via a session variable set during public ticket authentication, which REST API authentication never sets. Attackers with ticket read permission can enumerate predictable ticket identifiers and supply them to the documents endpoint or download path to retrieve sensitive attachments such as invoices and contracts belonging to other third parties.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-11-13
Last Modified
2026-11-13
Generated
2026-11-13
AI Q&A
2026-11-13
EPSS Evaluated
N/A
NVD
CVE-2026-89037
EUVD
EUVD-2026-125757

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
Dolibarr dolibarr From 0 (inc) to 24.0.2 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-639 The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-89037 is an Insecure Direct Object Reference (IDOR) vulnerability in Dolibarr before version 24.0.2. It affects the REST Documents API for the ticket module. Authenticated API users with ticket read permissions can access ticket attachments belonging to other companies by exploiting missing company-scope checks. The vulnerability occurs because the session variable enforcing company restrictions is only set during public ticket authentication, which the REST API does not use.

Detection Guidance

To detect this vulnerability, check if your Dolibarr instance is running a version prior to 24.0.2. Use commands like 'curl -s https://your-dolibarr-instance.com/htdocs/ | grep -i version' or check the admin panel for version details. Verify if the REST Documents API for the ticket module allows unauthorized access to attachments by testing with authenticated API calls and predictable ticket IDs.

Impact Analysis

Attackers with ticket read permissions can enumerate predictable ticket IDs and retrieve sensitive attachments like invoices and contracts belonging to other third parties. This could lead to unauthorized access to confidential business documents, financial data, or contracts across different companies using the same Dolibarr instance.

Compliance Impact

This vulnerability could lead to unauthorized access to personal or sensitive data, violating GDPR's data protection principles and HIPAA's privacy rules. It may result in data breaches, unauthorized disclosures, and non-compliance with regulatory requirements for data access controls and confidentiality.

Mitigation Strategies

Immediately upgrade Dolibarr to version 24.0.2 or later to address the IDOR vulnerability. Review API access logs for suspicious activity involving ticket attachments. Restrict API permissions to the minimum required and ensure proper company-scope checks are enforced in all endpoints.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-89037. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart

Security Radar

News mentioning this vulnerability
Loading related security news...