Authorization Bypass in Dolibarr Document Storage

Dolibarr versions 23.0.4 through 24.0.0 contain an authorization bypass vulnerability (CVE-2026-89013) that enables unauthenticated remote attackers to retrieve arbitrary files from the application server. The vulnerability exists within the document storage handling logic found in htdocs/document.php and htdocs/viewimage.php. By supplying a crafted 'hashp=shared' parameter in an HTTP request, an attacker can trick the application into skipping necessary token validation checks. This allows the attacker to bypass access controls and satisfy the authorization conditions required to read sensitive data. Impacted files include application logs, confidential business documents, database backups containing password hashes, and files stored across different multicompany entities. This vulnerability is critical due to the potential for full database compromise and unauthorized exposure of business-critical information.

Attack Chain

1. Attacker performs reconnaissance to identify the target Dolibarr instance.
2. Attacker crafts an HTTP GET or POST request targeting htdocs/document.php or htdocs/viewimage.php.
3. Attacker appends the 'hashp=shared' parameter to the URI query string to invoke the vulnerable code path.
4. The application processes the request, incorrectly bypassing the authentication token verification logic.
5. The application returns the requested file contents directly in the HTTP response body.
6. Attacker exfiltrates sensitive files, such as database backups or internal configuration logs.
7. Attacker uses credentials or metadata found in the exfiltrated files to escalate privileges or move laterally.

Impact

Successful exploitation leads to unauthorized disclosure of sensitive business information. Potential impacts include access to database backups containing password hashes, sensitive configuration files, internal application logs, and documents shared across multiple company entities. This access can be used to gain complete control over the Dolibarr instance or to facilitate further attacks against the organization's broader infrastructure.

Recommendation

1. Upgrade all instances of Dolibarr to version 24.0.1 or later to apply the official vendor patch.
2. Deploy the provided Sigma rule to detect exploitation attempts targeting the identified document endpoints.
3. Monitor web server logs for requests containing the 'hashp=shared' parameter string.
4. Conduct an audit of accessed files and user logs for unauthorized document retrieval following any identified exploitation attempts.