CVE-2026-89013: Dolibarr 23.0.4 < 24.0.1 Authorization Bypass via hashp Parameter in document.php
Dolibarr 23.0.4 before 24.0.1 ontains an authorization bypass vulnerability that allows unauthenticated attackers to read arbitrary files through the document storage endpoints by supplying a crafted hashp parameter value. Attackers can send a request with hashp=shared to skip token validation while satisfying the authorization condition in htdocs/document.php and htdocs/viewimage.php, gaining access to application logs, uploaded business documents, database backups containing password hashes, and files belonging to other multicompany entities.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
Unauthenticated remote attackers can exploit it over the network. No credentials or user interaction are required.
What data could be exposed?
An attacker may read arbitrary files available through the document storage endpoints, including application logs, uploaded business documents, database backups containing password hashes, and files from other multicompany entities.
What request condition triggers the bypass?
The bypass relies on supplying a crafted hashp parameter, specifically hashp=shared, to bypass token validation while meeting the authorization check in document.php and viewimage.php.
Which versions should be remediated?
Dolibarr versions from 23.0.4 before 24.0.1 are affected. Update to 24.0.1 or later.