{"cvss":8.7,"datePublished":"2026-09-17T00:00:00Z","dateUpdated":"2026-09-17T00:00:00Z","description":"Dolibarr 23.0.4 before 24.0.1 contains an authorization bypass vulnerability that allows unauthenticated attackers to read arbitrary files through the document storage endpoints by supplying a crafted hashp parameter value. Attackers can send a request with hashp=shared to skip token validation while satisfying the authorization condition in htdocs/document.php and htdocs/viewimage.php, gaining access to application logs, uploaded business documents, database backups containing password hashes, and files belonging to other multicompany entities.","dueDate":"","id":"CVE-2026-89013","kev_catalogs":["vulncheck"],"knownRansomwareCampaignUse":"Unknown","product":"dolibarr_erp\\/crm","requiredAction":"Apply remediations or mitigations per vendor instructions or discontinue use of the product if remediation or mitigations are unavailable.","severity":"HIGH","source":"vulncheck_kev","title":"dolibarr dolibarr_erp\\/crm Incorrect Authorization","vendor":"dolibarr"}