CVE-2026-89012: Dolibarr 24.0.0 SQL Filter Denylist Bypass via sqlfilters Parameter
Dolibarr 24.0.0 prior to commit 7a04d9c contains a case-sensitive denylist bypass vulnerability in the sqlfilters API query parameter that allows authenticated attackers to recover protected database fields by supplying uppercase variants of denylist-protected field names. Attackers can exploit the case-insensitive database column resolution against the case-sensitive denylist check in the core library to use prefix-matching predicates as a boolean oracle and extract full password hashes for any user account, including administrators.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Dolibarrto a version that resolves this vulnerability.Fixed in 24.0.0Patch 7a04d9c - Compensating control
Until the fix is applied, prevent authenticated attackers from accessing the /sqlfilters API query parameter (e.g., restrict access/route to trusted users or block the sqlfilters parameter at the application/WAF level).
Event History
Frequently Asked Questions
Who can exploit this issue?
An attacker needs an authenticated Dolibarr account with permission to issue API requests using the sqlfilters parameter. No user interaction is required.
What data can an attacker recover?
The bypass can be used as a boolean oracle to extract full password hashes from user accounts, including administrator accounts. The issue affects fields intended to be protected by the sqlfilters denylist.
Are systems running the default affected release exposed?
Dolibarr 24.0.0 is affected prior to commit 7a04d9c. The provided data does not identify any configuration prerequisite beyond access to the affected API parameter.
What should be done if the fix cannot be applied immediately?
Restrict access to the affected API functionality to only trusted authenticated users, because exploitation requires authentication and use of the sqlfilters parameter. Monitor API activity involving sqlfilters for uppercase variants of protected field names and prefix-matching predicates.
How can I determine whether the fix is present?
Verify whether the deployed Dolibarr source includes commit 7a04d9c970e45e15d29c91e6f5a34a262c6c51c8. Versions or releases containing that commit are not specified in the provided data.