Dolibarr ERP file-read flaw CVE-2026-89013 is reported exploited: update to 24.0.1

Dolibarr ERP file-read flaw CVE-2026-89013 is reported exploited: update to 24.0.1

30 September 2026: Dolibarr is an open-source ERP and CRM used by many small businesses, associations and the IT firms that host it for them. It has an authorisation-bypass vulnerability, CVE-2026-89013, which lets an unauthenticated attacker read arbitrary files. The flaw was disclosed and fixed in Dolibarr 24.0.1 in September. On 30 September 2026, Italy's national cyber agency (ACN / CSIRT Italia) reported that it is being exploited and that proof-of-concept code is public.

What the flaw does

According to the GitHub security advisory (GHSA-fm6p-42mr-x6jm, published 11 September 2026):

• Affected versions: Dolibarr 23.0.4 and later, before 24.0.1.
• The bug: attackers can send a request to the document storage endpoints (htdocs/document.php and htdocs/viewimage.php) with the hashp parameter set to "shared". This skips token validation while still satisfying the authorisation check.
• What can be read: application logs, uploaded business documents, database backups containing password hashes, and files belonging to other entities in multi-company set-ups.

The advisory rates it high, with a CVSS score of 7.5. ACN gives a CVSS 4.0 score of 8.7.

The 24.0.1 fix was not complete. A follow-up change merged on 14 September 2026, titled "Fix incomplete remediation of CVE-2026-89013 in website wrapper.php", says the original fix covered document.php and viewimage.php but missed htdocs/website/wrapper.php, which accepted the same hashp=shared bypass. We have not confirmed which release carries that change.

Why it matters

An ERP holds invoices, contracts, customer and supplier records and staff data. Backups with password hashes can lead to account takeover, and multi-company installations, often run by hosting providers for several clients, can leak one client's files to an attacker probing another's. The attack needs no login, so any Dolibarr reachable from the internet is exposed.

What to do

• Update every Dolibarr installation from 23.0.4 onwards to 24.0.1 or later.
• After updating, check that requests to website/wrapper.php with hashp=shared are also refused; if not, take the newest maintenance release of your branch or block that parameter at the web server.
• If it cannot be updated at once, block external access to document.php, viewimage.php and website/wrapper.php, or put the instance behind a VPN.
• Check web-server logs for requests to those endpoints, and to website/wrapper.php, carrying hashp=shared.
• If you find any, assume documents and backups were read: rotate user passwords and any credentials stored in documents.
• Hosting providers running Dolibarr for clients should patch every tenant and tell affected clients.

Update, 28 October 2026: VulnCheck's advisory of 11 September 2026 lists CVE-2026-89013 for Dolibarr 23.0.4 up to but not including 24.0.1, rated 8.7 under CVSS 4.0, describes the hashp=shared bypass in htdocs/document.php and htdocs/viewimage.php that lets an unauthenticated attacker read arbitrary files, and states that the advisory is in the VulnCheck KEV database. That is VulnCheck's own catalogue of exploited flaws, not CISA's: CISA's catalogue of 27 October 2026 does not list the CVE.

Sources

• GitHub Security Advisory GHSA-fm6p-42mr-x6jm: Dolibarr authorization bypass (CVE-2026-89013) - 11 September 2026
• Dolibarr release 24.0.1 - 11 September 2026
• ACN / CSIRT Italia: Dolibarr, rilevato sfruttamento in rete della CVE-2026-89013 - 30 September 2026
• Dolibarr pull request #40410: Fix incomplete remediation of CVE-2026-89013 in website wrapper.php - 14 September 2026
• VulnCheck: Dolibarr 23.0.4 < 24.0.1 Authorization Bypass via hashp Parameter in document.php, 11 September 2026