Dolibarr - Information Disclosure (CVE-2026-89013)

CVE-2026-89013 is a high-severity authorization bypass vulnerability in Dolibarr 23.0.4 before 24.0.1 that allows unauthenticated attackers to read arbitrary files through document storage endpoints by supplying a crafted hashp parameter. Successful exploitation can expose application logs, uploaded business documents, database backups containing password hashes, and files belonging to other multicompany entities.

CrowdSec has been tracking this vulnerability and its exploits since 5th of October 2026.

CrowdSec has not observed any significant exploitation activity targeting CVE-2026-89013 across its network. As a result, no community-driven trend analysis is available for this vulnerability at this time.

Attackers target Dolibarr’s /document.php endpoint by supplying hashp=shared to bypass authorization checks. They abuse the modulepart and file parameters to request arbitrary files from managed media directories without authentication.