CVE-2026-89013: Dolibarr Authorization Bypass Vulnerability

CVE-2026-89013 Overview

CVE-2026-89013 is an authorization bypass vulnerability in Dolibarr ERP/CRM versions 23.0.4 through 24.0.0. The flaw resides in document delivery endpoints that accept a hashp query parameter to grant public access to shared files. When an attacker supplies hashp=shared, the application skips token validation while still treating the request as authorized. Unauthenticated attackers can read arbitrary files served through htdocs/document.php and htdocs/viewimage.php, including application logs, uploaded business documents, database backups containing password hashes, and files belonging to other multicompany entities. The issue is tracked as CWE-863: Incorrect Authorization.

Critical Impact
Remote unauthenticated attackers can read sensitive files, including database backups with credential hashes, by sending a single crafted HTTP request.

Affected Products

Dolibarr ERP/CRM 23.0.4 and later 23.x releases
Dolibarr ERP/CRM releases prior to 24.0.1
Multicompany deployments sharing the same Dolibarr instance

Discovery Timeline

2026-09-11 - CVE-2026-89013 published to NVD
2026-09-17 - Last updated in NVD database

Technical Details for CVE-2026-89013

Vulnerability Analysis

Dolibarr exposes public document endpoints that authorize requests carrying a valid hashp token linked to a shared file. The authorization check evaluates whether hashp is non-empty and treats any non-empty value as a legitimate share token. Supplying the literal string shared satisfies the non-empty check, and the downstream lookup logic then resolves the requested file parameter without further authentication. This lets an attacker use the endpoint as a generic file read primitive against paths reachable by the web server user, including tenant data in multicompany environments.

Root Cause

The root cause is missing validation of the hashp parameter contents. Both htdocs/document.php and htdocs/viewimage.php delegate share resolution to helper code without rejecting reserved sentinel values. The upstream fix in htdocs/core/lib/functions.lib.php explicitly clears the parameter when the value equals shared, and callers such as htdocs/website/samples/wrapper.php add an equality check against the same string before performing lookups.

Attack Vector

Exploitation requires only network access to the Dolibarr web interface. An attacker issues an HTTP GET request to document.php or viewimage.php with hashp=shared and a file parameter pointing to the desired target. No credentials, user interaction, or prior knowledge of share tokens is required. The response returns the raw file contents, enabling harvesting of backup archives and log files that expose password hashes and internal business data.

php

// Patch: htdocs/core/lib/functions.lib.php
// Reject the reserved value 'shared' when supplied as hashp
		}
	}

+	if ($paramname == 'hashp' && $out == 'shared') {
+		$out = ''; // We refuse to have hashp=shared as a parameter
+	}
+
	return $out;
}
// Source: https://github.com/Dolibarr/dolibarr/commit/cd05688dbed8a4af6eef32faf4fc1e823a37bce9

php

// Patch: htdocs/website/samples/wrapper.php
// Require hashp to be non-empty AND not equal to 'shared' before resolving files
// If we have a hash public (hashp), we guess the original_file.
-if (!empty($hashp)) {
+if (!empty($hashp) && $hashp != 'shared') {
	include_once DOL_DOCUMENT_ROOT.'/ecm/class/ecmfiles.class.php';
	include_once DOL_DOCUMENT_ROOT.'/core/lib/images.lib.php';
	$ecmfile = new EcmFiles($db);
// Source: https://github.com/Dolibarr/dolibarr/commit/cd05688dbed8a4af6eef32faf4fc1e823a37bce9

Detection Methods for CVE-2026-89013

Indicators of Compromise

HTTP requests to /document.php or /viewimage.php containing the query string hashp=shared.
Unauthenticated access log entries retrieving .sql, .sql.gz, .log, or backup archive filenames through document endpoints.
Repeated file parameter values traversing ECM (Electronic Content Management) directories or documents/admin/ paths from a single source IP.

Detection Strategies

Deploy a web application firewall rule that blocks or alerts on any request where hashp equals shared (case-insensitive) against Dolibarr endpoints.
Correlate anonymous document downloads with backup filename patterns to surface bulk file harvesting.
Alert on 200 responses to document.php or viewimage.php where the requesting session lacks an authenticated Dolibarr cookie.

Monitoring Recommendations

Enable verbose access logging on the reverse proxy fronting Dolibarr and retain URL query strings for at least 90 days.
Monitor egress volumes from the Dolibarr host for unusual outbound transfers that could indicate exfiltration of backup files.
Track file-system access to the documents/ directory and alert when non-application processes read backup archives.

How to Mitigate CVE-2026-89013

Immediate Actions Required

Upgrade all Dolibarr instances to version 24.0.1 or later, which contains commit cd05688dbed8a4af6eef32faf4fc1e823a37bce9.
Rotate credentials stored in any database backups that were reachable through the vulnerable endpoints, including administrator and SMTP passwords.
Review web server access logs for prior requests containing hashp=shared and treat any matching downloads as confirmed data exposure.

Patch Information

The fix is available in the Dolibarr 24.0.1 release. Technical details of the patched files are documented in the upstream commit and the VulnCheck Authorization Bypass Advisory.

Workarounds

Configure the reverse proxy or WAF to drop requests where the hashp query parameter equals shared before they reach document.php or viewimage.php.
Restrict network access to the Dolibarr instance to trusted IP ranges or place it behind an authenticating proxy until the upgrade is completed.
Relocate database backup artifacts outside the documents/ directory tree so they are not reachable through the ECM file resolver.

bash

# Example nginx rule blocking exploitation attempts against Dolibarr
location ~ ^/(document|viewimage)\.php$ {
    if ($arg_hashp ~* "^shared$") {
        return 403;
    }
    include fastcgi_params;
    fastcgi_pass unix:/run/php/php-fpm.sock;
}