Insecure Direct Object Reference in Dolibarr REST Documents API

CVE-2026-89037

What is CVE-2026-89037?

Dolibarr versions prior to 24.0.2 are affected by an insecure direct object reference vulnerability within the REST Documents API for the ticket module. This flaw allows authenticated users of the API to access sensitive ticket attachments from different companies. The vulnerability arises due to the absence of a proper company-scope check, which is typically enforced through session variables during public ticket authentication. As a result, attackers possessing ticket read permissions can easily exploit this weakness by predicting ticket identifiers. They can then utilize these identifiers to retrieve confidential documents, including invoices and contracts, by manipulating the documents endpoint.

References