CVE-2026-89013
Received Received - Intake

Authorization Bypass in Dolibarr via Hashp Parameter

Publication date: 2026-09-11

Last updated on: 2026-09-11

Assigner: VulnCheck

Description
Dolibarr 23.0.4 before 24.0.1 ontains an authorization bypass vulnerability that allows unauthenticated attackers to read arbitrary files through the document storage endpoints by supplying a crafted hashp parameter value. Attackers can send a request with hashp=shared to skip token validation while satisfying the authorization condition in htdocs/document.php and htdocs/viewimage.php, gaining access to application logs, uploaded business documents, database backups containing password hashes, and files belonging to other multicompany entities.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-11
Last Modified
2026-09-11
Generated
2026-09-11
AI Q&A
2026-09-11
EPSS Evaluated
N/A
NVD
CVE-2026-89013
EUVD
EUVD-2026-76144

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
dolibarr dolibarr to 24.0.1 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-863 The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is an authorization bypass in Dolibarr versions 23.0.4 through 23.0.1 that allows unauthenticated attackers to read arbitrary files by exploiting the hashp parameter. By setting hashp=shared, attackers bypass token validation in document.php and viewimage.php, gaining access to sensitive files like application logs, business documents, database backups with password hashes, and files from other multi-company entities.

Detection Guidance

Check Dolibarr version with: grep -r "version" /var/www/html/dolibarr/htdocs/core/class/conf/Setup.class.php. If version is below 24.0.1, the system is vulnerable. Inspect web server logs for requests containing hashp=shared to document.php or viewimage.php.

Impact Analysis

Unauthenticated attackers can access sensitive data including application logs, uploaded business documents, database backups containing password hashes, and files belonging to other multi-company entities. This could lead to data breaches, unauthorized information disclosure, and potential further attacks using exposed credentials.

Compliance Impact

This vulnerability likely violates compliance requirements for data protection standards like GDPR and HIPAA by enabling unauthorized access to sensitive personal and business data. Organizations using affected Dolibarr versions may face regulatory penalties, loss of certification, and reputational damage due to data exposure.

Mitigation Strategies

Upgrade Dolibarr to version 24.0.1 or later immediately. Apply the patch from the commit cd05688dbed8a4af6eef32faf4fc1e823a37bce9 if upgrading is not immediately possible.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-89013. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart