{"id":"CVE-2026-89037","kind":"vulnerability","aliases":["CVE-2026-89037"],"related":[],"title":"Dolibarr: REST Documents API leaks other companies' ticket attachments","description":"Dolibarr before 24.0.2 contains an insecure direct object reference vulnerability in the REST Documents API for the ticket module that allows authenticated API users to access ticket attachments belonging to other companies by omitting a company-scope check that is only applied via a session variable set during public ticket authentication, which REST API authentication never sets. Attackers with ticket read permission can enumerate predictable ticket identifiers and supply them to the documents endpoint or download path to retrieve sensitive attachments such as invoices and contracts belonging to other third parties.","summary":"Dolibarr before 24.0.2 skips a company-scope check in the REST Documents API for tickets. An authenticated API user with ticket read permission can fetch attachments such as invoices and contracts belonging to other third parties.","severity":"high","cvss":7.1,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["dolibarr","package","rest-api","self-hosted","ticket-module"],"not_affected_if":["no-ticket-read-permission","rest-api-disabled","ticket-module-disabled"],"how_to_check":"- Check the installed Dolibarr version; versions below `24.0.2` are in range.\n- Confirm whether the REST API is enabled and which users hold ticket read permission.","fix":"- Dolibarr: move to `24.0.2` or later.","status":"open","published_at":"2026-11-13T21:17:48+00:00","first_seen_at":"2026-11-13T21:33:41+00:00","triaged_at":"2026-11-13T21:33:46+00:00","updated_at":"2026-11-13T21:33:46+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-11-13T21:33:46Z","model":"claude-haiku-5-5","output":{"fix":"- Dolibarr: move to `24.0.2` or later.","reach":"network","title":"Dolibarr: REST Documents API leaks other companies' ticket attachments","impact":"medium","summary":"Dolibarr before 24.0.2 skips a company-scope check in the REST Documents API for tickets. An authenticated API user with ticket read permission can fetch attachments such as invoices and contracts belonging to other third parties.","audience":"businesses","category":"package","nicknames":[],"who_cares":["dolibarr","self-hosted","rest-api","ticket-module"],"confidence":0.7,"fix_status":"available","needs_auth":"yes","worst_case":"Authenticated API users read other companies' invoices and contracts","analyst_note":"","how_to_check":"- Check the installed Dolibarr version; versions below `24.0.2` are in range.\n- Confirm whether the REST API is enabled and which users hold ticket read permission.","plain_action":"","product_name":"","needs_analyst":false,"not_affected_if":["rest-api-disabled","ticket-module-disabled","no-ticket-read-permission"],"who_is_affected":"Companies running Dolibarr with the REST API and the ticket module enabled, where API users hold ticket read permission. Instances without the REST API or the ticket module are not exposed by this flaw. Exposure depends on what attachments other companies have stored on tickets.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"yes","severity_if_unknown":"high"},"cost_usd":0.000725,"input_tokens":4684,"output_tokens":513,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-2026':11A,14A '-89037':12A,15A '24.0.2':29B,66C 'access':89C 'allow':84C 'api':4A,20B,40B,45B,78C,86C,118C 'appli':106C 'attach':9A,53B,91C,145C 'attack':122C 'authent':44B,85C,115C,119C 'belong':59B,92C,151C 'check':35B,102C 'compani':7A,33B,95C,100C 'company-scop':32B,99C 'contain':67C 'contract':58B,150C 'cve':10A,13A 'direct':70C 'document':3A,39B,77C,137C 'dolibarr':1A,16B,27B,64C 'download':140C 'endpoint':138C 'enumer':128C 'fetch':52B 'host':23B 'identifi':131C 'insecur':69C 'invoic':56B,148C 'leak':5A 'modul':26B,82C 'never':120C 'object':71C 'omit':97C 'packag':17B 'parti':63B,155C 'path':141C 'permiss':50B,126C 'predict':129C 'public':113C 'read':49B,125C 'refer':72C 'rest':2A,19B,38B,76C,117C 'rest-api':18B 'retriev':143C 'scope':34B,101C 'self':22B 'self-host':21B 'sensit':144C 'session':109C 'set':111C,121C 'skip':30B 'suppli':133C 'third':62B,154C 'ticket':8A,25B,42B,48B,81C,90C,114C,124C,130C 'ticket-modul':24B 'user':46B,87C 'variabl':110C 'via':107C 'vulner':73C","nicknames":[],"mitigations":[],"who_affected":"Companies running Dolibarr with the REST API and the ticket module enabled, where API users hold ticket read permission. Instances without the REST API or the ticket module are not exposed by this flaw. Exposure depends on what attachments other companies have stored on tickets.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["dolibarr","high","package","restapi","selfhosted","ticketmodule"],"campaign_type":null,"search_a":"'-2026':11A,14A '-89037':12A,15A 'api':4A 'attach':9A 'compani':7A 'cve':10A,13A 'document':3A 'dolibarr':1A 'leak':5A 'rest':2A 'ticket':8A","search_b":"'24.0.2':29B 'api':20B,40B,45B 'attach':53B 'authent':44B 'belong':59B 'check':35B 'compani':33B 'company-scop':32B 'contract':58B 'document':39B 'dolibarr':16B,27B 'fetch':52B 'host':23B 'invoic':56B 'modul':26B 'packag':17B 'parti':63B 'permiss':50B 'read':49B 'rest':19B,38B 'rest-api':18B 'scope':34B 'self':22B 'self-host':21B 'skip':30B 'third':62B 'ticket':25B,42B,48B 'ticket-modul':24B 'user':46B","search_c":"'24.0.2':66C 'access':89C 'allow':84C 'api':78C,86C,118C 'appli':106C 'attach':91C,145C 'attack':122C 'authent':85C,115C,119C 'belong':92C,151C 'check':102C 'compani':95C,100C 'company-scop':99C 'contain':67C 'contract':150C 'direct':70C 'document':77C,137C 'dolibarr':64C 'download':140C 'endpoint':138C 'enumer':128C 'identifi':131C 'insecur':69C 'invoic':148C 'modul':82C 'never':120C 'object':71C 'omit':97C 'parti':155C 'path':141C 'permiss':126C 'predict':129C 'public':113C 'read':125C 'refer':72C 'rest':76C,117C 'retriev':143C 'scope':101C 'sensit':144C 'session':109C 'set':111C,121C 'suppli':133C 'third':154C 'ticket':81C,90C,114C,124C,130C 'user':87C 'variabl':110C 'via':107C 'vulner':73C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-13T21:17:48+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-89037","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-89037","severity":null,"published_at":"2026-11-13T21:17:48+00:00","modified_at":"2026-11-13T21:17:48+00:00","first_seen_at":"2026-11-13T21:33:41+00:00","fetched_at":"2026-11-13T21:33:41+00:00","note":null}],"documents":[{"id":150328,"url":"https://github.com/Dolibarr/dolibarr/commit/f815deb1c234168a69623101a26ae71f8c384c46","title":"Patch: github.com","kind":"other","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":150329,"url":"https://github.com/Dolibarr/dolibarr/releases/tag/24.0.2","title":"Release notes: github.com","kind":"release","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Release notes: github.com"},{"id":150330,"url":"https://www.vulncheck.com/advisories/dolibarr-idor-via-ticket-documents-api","title":"Third-party advisory: www.vulncheck.com","kind":"advisory","source":"nvd","publisher":"research","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Third-party advisory: www.vulncheck.com"}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}