Case-Sensitive Denylist Bypass Vulnerability in Dolibarr Software

CVE-2026-89012

What is CVE-2026-89012?

Dolibarr versions prior to 24.0.1 exhibit a vulnerability tied to the sqlfilters API query parameter, resulting in a case-sensitive denylist bypass. Authenticated attackers can exploit this flaw by entering uppercase variants of denylist-protected field names, thus circumventing the protective checks. This weakness arises from the case-insensitive resolution of database columns conflicting with the case-sensitive assessments in the core library, permitting attackers to leverage prefix-matching predicates as a boolean oracle. Consequently, they can retrieve sensitive information, including full password hashes for user accounts, potentially compromising both standard and administrative accounts.

References