Medium 6.5Published Sep 11, 2026

CVE-2026-89012Dolibarr 24.0.0 < 24.0.1 SQL Filter Denylist Bypass via sqlfilters Parameter

Updated under an hour ago (2026-10-19 08:50 UTC)

Does this affect you?

It affects Dolibarr. Add what you run to find out whether that includes you.

No exploitation reported and no EPSS estimate yet.

Do this next

Start free and add your stack

Free account, 1 product

Every CVE for Dolibarr

Exploited in the last 30 days

Dolibarr 24.0.0 before 24.0.1 contains a case-sensitive denylist bypass vulnerability in the sqlfilters API query parameter that allows authenticated attackers to recover protected database fields by supplying uppercase variants of denylist-protected field names. Attackers can exploit the case-insensitive database column resolution against the case-sensitive denylist check in the core library to use prefix-matching predicates as a boolean oracle and extract full password hashes for any user account, including administrators.

CVSS: 6.5 MEDIUM (v3.1, CNA)CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Weakness (CWE): CWE-178
Known exploited: Not in CISA's KEV catalog
EPSS (exploitation in the next 30 days): Not loaded for this CVE
Assigned by: VulnCheck
NVD analysis: Deferred
Record last updated: Oct 1, 2026
First seen by InfoSec Signals: Oct 9, 2026

Affected products

Affected products

Dolibarr Dolibarr dolibarr:dolibarr (from the name)	from 24.0.0 before 24.0.1	CNA record

References

https://github.com/Dolibarr/dolibarr/releases/tag/24.0.1release-notes
https://github.com/Dolibarr/dolibarr/commit/7a04d9c970e45e15d29c91e6f5a34a262c6c51c8patch
https://www.vulncheck.com/advisories/dolibarr-sql-filter-denylist-bypass-via-sqlfilters-parameterthird-party-advisory

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.