CVE-2026-89037 · Package
NO FIX YET · SEE WHAT TO DO
Dolibarr before 24.0.2 skips a company-scope check in the REST Documents API for tickets. An authenticated API user with ticket read permission can fetch attachments such as invoices and contracts belonging to other third parties.
first public Nov 13, 2026 · 1 source
Check it with your coding agent
It reads this page and tells you if your code or app is affected.
Companies running Dolibarr with the REST API and the ticket module enabled, where API users hold ticket read permission. Instances without the REST API or the ticket module are not exposed by this flaw. Exposure depends on what attachments other companies have stored on tickets.
Not affected if no-ticket-read-permission, rest-api-disabled, ticket-module-disabled
Who cares dolibarr, rest-api, self-hosted, ticket-module
24.0.2 are in range.24.0.2 or later.Dolibarr before 24.0.2 contains an insecure direct object reference vulnerability in the REST Documents API for the ticket module that allows authenticated API users to access ticket attachments belonging to other companies by omitting a company-scope check that is only applied via a session variable set during public ticket authentication, which REST API authentication never sets. Attackers with ticket read permission can enumerate predictable ticket identifiers and supply them to the documents endpoint or download path to retrieve sensitive attachments such as invoices and contracts belonging to other third parties.
This page as ·
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
InfraStack checks it against your stack and answers on your report, with the evidence and the fix.
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.