Authorization Bypass Vulnerability in Dolibarr Software

CVE-2026-89013

What is CVE-2026-89013?

Dolibarr versions prior to 24.0.1 are susceptible to an authorization bypass vulnerability that enables unauthenticated attackers to read sensitive files. By exploiting a flaw in the document storage endpoints, attackers can leverage a crafted 'hashp' parameter to bypass token validation in critical scripts like document.php and viewimage.php. This vulnerability can expose application logs, uploaded documents, database backups containing password hashes, and files belonging to other companies within a multi-company setup, significantly compromising data security.

References