CVE-2026-89012

Medium

Description

Dolibarr 24.0.0 before 24.0.1 contains a case-sensitive denylist bypass vulnerability in the sqlfilters API query parameter that allows authenticated attackers to recover protected database fields by supplying uppercase variants of denylist-protected field names. Attackers can exploit the case-insensitive database column resolution against the case-sensitive denylist check in the core library to use prefix-matching predicates as a boolean oracle and extract full password hashes for any user account, including administrators.

SeverityMedium

CVSS6.5

Exploit probability—

ProductDolibarr

PublishedSep 11, 2026

First seenSep 11, 2026

Weakness typeCWE-178CWE-178

How to fix

Update

Dolibarr Dolibarr24.0.1 or later

Patches

github.com/Dolibarr/dolibarr/commit/7a04d9c970e45e15d29c91e6f5a34a262c6c51c8

Vendor advisories

github.com/Dolibarr/dolibarr/releases/tag/24.0.1

Affected products

Product	Affected versions	Fixed in
Dolibarr Dolibarr	24.0.0 ≤ v < 24.0.1	24.0.1

Check your version

Choose the product and enter the version you run to see whether it falls in the affected range.

In the Intelligence 360 plan

Attack Surface Management

See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.