Dolibarr ERP file-read flaw CVE-2026-89013 is reported exploited: update to 24.0.1

Dolibarr ERP file-read flaw CVE-2026-89013 is reported exploited: update to 24.0.1

30 September 2026: Dolibarr is an open-source ERP and CRM used by many small businesses, associations and the IT firms that host it for them. It has an authorisation-bypass vulnerability, CVE-2026-89013, which lets an unauthenticated attacker read arbitrary files. The flaw was disclosed and fixed in Dolibarr 24.0.1 in September. On 30 September 2026, Italy's national cyber agency (ACN / CSIRT Italia) reported that it is being exploited and that proof-of-concept code is public.

What the flaw does

According to the GitHub security advisory (GHSA-fm6p-42mr-x6jm, published 11 September 2026):

• Affected versions: Dolibarr 23.0.4 and later, before 24.0.1.
• The bug: attackers can send a request to the document storage endpoints (htdocs/document.php and htdocs/viewimage.php) with the hashp parameter set to "shared". This skips token validation while still satisfying the authorisation check.
• What can be read: application logs, uploaded business documents, database backups containing password hashes, and files belonging to other entities in multi-company set-ups.

The advisory rates it high, with a CVSS score of 7.5. ACN gives a CVSS 4.0 score of 8.7.

The 24.0.1 fix was not complete. A follow-up change merged on 14 September 2026, titled "Fix incomplete remediation of CVE-2026-89013 in website wrapper.php", says the original fix covered document.php and viewimage.php but missed htdocs/website/wrapper.php, which accepted the same hashp=shared bypass. We have not confirmed which release carries that change.

Why it matters

An ERP holds invoices, contracts, customer and supplier records and staff data. Backups with password hashes can lead to account takeover, and multi-company installations, often run by hosting providers for several clients, can leak one client's files to an attacker probing another's. The attack needs no login, so any Dolibarr reachable from the internet is exposed.

Not yet independently verified. The report that the flaw is being exploited comes from Italy’s national cyber agency alone; the Dolibarr project’s own pages read so far describe the fix but do not mention exploitation. We will update this when it can be confirmed, and remove this note.

What to do

• Update every Dolibarr installation from 23.0.4 onwards to 24.0.1 or later.
• After updating, check that requests to website/wrapper.php with hashp=shared are also refused; if not, take the newest maintenance release of your branch or block that parameter at the web server.
• If it cannot be updated at once, block external access to document.php, viewimage.php and website/wrapper.php, or put the instance behind a VPN.
• Check web-server logs for requests to those endpoints, and to website/wrapper.php, carrying hashp=shared.
• If you find any, assume documents and backups were read: rotate user passwords and any credentials stored in documents.
• Hosting providers running Dolibarr for clients should patch every tenant and tell affected clients.

Sources

• GitHub Security Advisory GHSA-fm6p-42mr-x6jm: Dolibarr authorization bypass (CVE-2026-89013) - 11 September 2026
• Dolibarr release 24.0.1 - 11 September 2026
• ACN / CSIRT Italia: Dolibarr, rilevato sfruttamento in rete della CVE-2026-89013 - 30 September 2026
• Dolibarr pull request #40410: Fix incomplete remediation of CVE-2026-89013 in website wrapper.php - 14 September 2026