CVE-2026-89012: Dolibarr Authentication Bypass Vulnerability

CVE-2026-89012 Overview

CVE-2026-89012 is an authorization bypass vulnerability in Dolibarr ERP/CRM version 24.0.0 before 24.0.1. The flaw exists in the sqlfilters API query parameter, where a case-sensitive denylist check fails to block uppercase variants of protected field names. Because the underlying database resolves column names case-insensitively, authenticated attackers can reference denylisted fields such as password hash columns by altering their case. Exploitation turns prefix-matching predicates into a boolean oracle, enabling character-by-character extraction of password hashes for any user, including administrators. The issue is tracked as CWE-178: Improper Handling of Case Sensitivity.

Critical Impact
Authenticated attackers can extract full administrator password hashes from Dolibarr 24.0.0 through the sqlfilters API parameter.

Affected Products

Dolibarr ERP/CRM 24.0.0
Fixed in Dolibarr 24.0.1
Component: htdocs/core/lib/functions.lib.php (sqlfilters processing)

Discovery Timeline

2026-09-11 - CVE-2026-89012 published to the National Vulnerability Database (NVD)
2026-09-11 - Last updated in NVD database

Technical Details for CVE-2026-89012

Vulnerability Analysis

Dolibarr exposes REST API endpoints that accept a sqlfilters query parameter for filtering records. The core library maintains a denylist of protected field names, such as password hash columns, that must never appear in filter operands. The denylist comparison is performed with in_array() against the operand as supplied by the caller. Because operand names arrive as strings, any change in letter case bypasses the check while the database still resolves the identifier to the intended column.

Once an attacker references a protected column, they can use SQL prefix-matching predicates like LIKE to build a boolean oracle. Each request confirms or denies a candidate prefix of the target value, allowing byte-by-byte reconstruction of password hashes belonging to arbitrary user accounts.

Root Cause

The root cause is a case-sensitivity mismatch between the application-layer denylist and the database-layer identifier resolution [CWE-178]. The pre-patch code stripped the table prefix from the operand and compared the remainder directly against the forbidden field list. Supplying PASSWORD instead of password bypasses the string comparison while MySQL, MariaDB, and similar backends still resolve the column normally.

Attack Vector

An attacker with valid API credentials submits crafted sqlfilters expressions that reference protected columns in mixed or uppercase form. They then iterate prefix comparisons through the filter, observing whether each request returns matching rows to infer each character of a target hash.

php

// Test that operand is not a forbidden search field
if (!empty($newforbiddenfields)) {
    $operandwithoutprefix = preg_replace('/^[a-z0-9_]+\./i', '', $operand);	// Remove prefix like t. or o. or s. or u. or d. or ...
-	if (in_array($operandwithoutprefix, $newforbiddenfields)) {
+	if (in_array(strtolower($operandwithoutprefix), $newforbiddenfields)) {
        return '1=1';
    }
}

Source: Dolibarr commit 7a04d9c. The patch normalizes the operand with strtolower() before checking the denylist, closing the case-sensitivity gap.

Detection Methods for CVE-2026-89012

Indicators of Compromise

API requests to Dolibarr endpoints containing sqlfilters parameters that reference field names in mixed case or uppercase, such as PASSWORD, Pass, or PASS_CRYPTED.
High-volume, repetitive API calls from a single authenticated session that differ only by one or two characters in the filter value, indicating oracle-style enumeration.
Unexpected read access to user or administrator records shortly after suspicious sqlfilters traffic.

Detection Strategies

Log and inspect all HTTP query strings submitted to Dolibarr REST endpoints for the substring sqlfilters= and flag operand tokens that are not fully lowercase.
Correlate authenticated API sessions producing large numbers of similar requests within short windows against baseline user behavior.
Alert on filter expressions using LIKE operators combined with wildcards against user-related tables.

Monitoring Recommendations

Enable web server and application access logging with full query-string retention for Dolibarr API paths.
Forward Dolibarr and reverse-proxy logs to a centralized analytics platform for correlation, retention, and hunting.
Track authentication events for administrators immediately following suspected enumeration activity to identify credential misuse.

How to Mitigate CVE-2026-89012

Immediate Actions Required

Upgrade Dolibarr to version 24.0.1 or later, which applies the strtolower() normalization fix.
Rotate credentials for all Dolibarr accounts, prioritizing administrators, if the vulnerable version was internet-exposed.
Review API access logs for suspicious sqlfilters usage predating the upgrade.

Patch Information

The vendor fix is committed in Dolibarr commit 7a04d9c and shipped in the Dolibarr 24.0.1 release. Additional context is available in the VulnCheck advisory.

Workarounds

Restrict access to Dolibarr REST API endpoints to trusted networks or VPN clients until patching is complete.
Disable API tokens for accounts that do not require programmatic access, reducing the pool of usable credentials for exploitation.
Deploy a web application firewall rule that rejects sqlfilters values referencing sensitive column names in any case variant.

bash

# Example WAF rule (ModSecurity) to block mixed-case sensitive field references in sqlfilters
SecRule ARGS:sqlfilters "@rx (?i)(password|pass_crypted|api_key|salt)" \
    "id:1026089012,phase:2,deny,status:403,log,msg:'Dolibarr CVE-2026-89012 sqlfilters denylist bypass attempt'"