---
id: "CVE-2026-89037"
page: "https://infrastack.ai/live/CVE-2026-89037"
kind: "vulnerability"
aliases: ["CVE-2026-89037"]
title: "Dolibarr: REST Documents API leaks other companies' ticket attachments"
severity: "high"
cvss: 7.1
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["dolibarr", "package", "rest-api", "self-hosted", "ticket-module"]
not_affected_if: ["no-ticket-read-permission", "rest-api-disabled", "ticket-module-disabled"]
published_at: "2026-11-13T21:17:48+00:00"
first_seen_at: "2026-11-13T21:33:41+00:00"
updated_at: "2026-11-13T21:33:46+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-89037", "first_seen_at": "2026-11-13T21:33:41+00:00"}]
exploit_sources: []
---

# Dolibarr: REST Documents API leaks other companies' ticket attachments

Link for people: https://infrastack.ai/live/CVE-2026-89037 (this .md is for agents)

Dolibarr before 24.0.2 skips a company-scope check in the REST Documents API for tickets. An authenticated API user with ticket read permission can fetch attachments such as invoices and contracts belonging to other third parties.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed Dolibarr version; versions below `24.0.2` are in range.
- Confirm whether the REST API is enabled and which users hold ticket read permission.

## Fix

- Dolibarr: move to `24.0.2` or later.

## Timeline

- 2026-11-13T21:33:41+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-89037

## Documents

- [advisory] Third-party advisory: www.vulncheck.com https://www.vulncheck.com/advisories/dolibarr-idor-via-ticket-documents-api
- [fix] Patch: github.com https://github.com/Dolibarr/dolibarr/commit/f815deb1c234168a69623101a26ae71f8c384c46
- [fix] Release notes: github.com https://github.com/Dolibarr/dolibarr/releases/tag/24.0.2

## From the sources

Dolibarr before 24.0.2 contains an insecure direct object reference vulnerability in the REST Documents API for the ticket module that allows authenticated API users to access ticket attachments belonging to other companies by omitting a company-scope check that is only applied via a session variable set during public ticket authentication, which REST API authentication never sets. Attackers with ticket read permission can enumerate predictable ticket identifiers and supply them to the documents endpoint or download path to retrieve sensitive attachments such as invoices and contracts belonging to other third parties.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_