CVE-2026-89037

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-89037
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-89037.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-89037
Published
2026-11-13T20:26:25Z
Modified
2026-11-14T10:45:19Z
Severity
  • 7.1 (High) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N CVSS Calculator
Summary
Dolibarr < 24.0.2 IDOR via Ticket Documents API
Details

Dolibarr before 24.0.2 contains an insecure direct object reference vulnerability in the REST Documents API for the ticket module that allows authenticated API users to access ticket attachments belonging to other companies by omitting a company-scope check that is only applied via a session variable set during public ticket authentication, which REST API authentication never sets. Attackers with ticket read permission can enumerate predictable ticket identifiers and supply them to the documents endpoint or download path to retrieve sensitive attachments such as invoices and contracts belonging to other third parties.

Database specific 
{
    "cna_assigner": "VulnCheck",
    "cwe_ids": [
        "CWE-639"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/89xxx/CVE-2026-89037.json"
}
References

Affected packages

Git / github.com/dolibarr/dolibarr

Affected ranges

Type
GIT
Repo
https://github.com/dolibarr/dolibarr
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
7e927764767343334aaa067ca5ec054cfea0a26b
Fixed
f815deb1c234168a69623101a26ae71f8c384c46
Database specific
Show details 
{
    "extracted_events": [
        {
            "range": [
                {
                    "introduced": "0"
                },
                {
                    "fixed": "24.0.2"
                }
            ],
            "source": "AFFECTED_FIELD",
            "strategy": "StandardRange"
        },
        {
            "original_tag": "24.0.2",
            "range": [
                {
                    "fixed": "7e927764767343334aaa067ca5ec054cfea0a26b"
                }
            ],
            "source": "REFERENCES_TAG"
        },
        {
            "range": [
                {
                    "fixed": "f815deb1c234168a69623101a26ae71f8c384c46"
                }
            ],
            "source": "REFERENCES_COMMIT"
        }
    ]
}

Affected versions

14.*
14.0.0
14.0.1
24.*
24.0.0
24.0.1
3.*
3.3.beta1_20121221
3.4.beta1_20130429
3.4.beta1_20130502
3.5.beta1_20131106
3.5.beta1_20131120
3.6.0
3.6.0-alpha
3.6.0-beta
3.6.1
3.6.2
3.6.beta1_20140514
3.7.0
3.7.1
3.8.0-beta
4.*
4.0.0-rc
5.*
5.0.0-beta
6.*
6.0.0-beta
Other
lne_audit_init_20260601

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-89037.json"