VulnSocial

CVE-2026-89013Active Exploitation

HIGHCVSS 8.7 · HIGH

Exploitation ongoing with high activity in latest observed window (1 mentions)

Immediate actions

  • Patch affected systems immediately
  • Assume compromise if assets are exposed
  • Hunt for exploitation attempts and persistence artifacts
  • Increase monitoring for publicly documented tradecraft

Recommended action window: Immediate (within 24h)

NVD description

Dolibarr 23.0.4 before 24.0.1 contains an authorization bypass vulnerability that allows unauthenticated attackers to read arbitrary files through the document storage endpoints by supplying a crafted hashp parameter value. Attackers can send a request with hashp=shared to skip token validation while satisfying the authorization condition in htdocs/document.php and htdocs/viewimage.php, gaining access to application logs, uploaded business documents, database backups containing password hashes, and files belonging to other multicompany entities.

Back to dashboard
7.5/ 10 priority

Sources & remediation

Other references
Weakness type (CWE)
CWE-863

Priority

HIGH

Exploitation

ACTIVE

PoC

YES

Patch

AVAILABLE

Momentum

STABLE

Threat summary

  • Active exploitation appears in 2 classified signals
  • Public PoC and exploit tooling are both present
  • Patch or workaround signal is available
  • 4 mentions across 4 observed days

What's happening

  • Active exploitation reported across 2 signals
  • Exploit tool or code specified in 1 signal
  • PoC mentioned or linked in 2 signals
  • Patch or workaround mentioned in 1 signal
  • Technical details provided in 4 signals
  • Peaked 3d ago at 1 mentions (2026-09-17); latest day: 1
  • 4 total mentions across 4 days

Deep dive

Activity timeline4 mentions / 4d
00111Mentions · 2026-09-17: 1Mentions · 2026-09-21: 1Mentions · 2026-09-28: 1Mentions · 2026-09-30: 1PoC Mentioned / Linked · 2026-09-21: 1PoC Mentioned / Linked · 2026-09-28: 1Exploit Tool / Code · 2026-09-21: 1Active Exploitation · 2026-09-17: 1Active Exploitation · 2026-09-30: 1Patch / Workaround · 2026-09-17: 1Technical Details · 2026-09-17: 1Technical Details · 2026-09-21: 1Technical Details · 2026-09-28: 1Technical Details · 2026-09-30: 109-1709-2109-2809-30
Signal classification3 categories
Active Exploitation
250.0%
Exploit
125.0%
PoC
125.0%
Referenced assets4 URLs
Classification over time
DateTotalLabels
2026-09-171
Active Exploitation1
2026-09-211
Exploit1
2026-09-281
PoC1
2026-09-301
Active Exploitation1
Full discourse4 posts
  • dbugs@ptdbugs
    Exploit

    A PoC/exploit has been discovered for vulnerability CVE-2026-89013 PT ID: PT-2026-89907 Vendor: Dolibarr Product: Dolibarr Description: Dolibarr 23.0.4 before 24.0.1 contains an authorization bypass vulnerability that allows unauthenticated attackers to read arbitrary files through the document storage endpoints by supplying a crafted hashp parameter value. Attackers can send a request with hashp=shared to skip token validation while satisfying the authorization condition in htdocs/document.php and htdocs/viewimage.php, gaining access to application logs, uploaded business documents, database backups containing password hashes, and files belonging to other multicompany entities. References: • https://dbu.gs/vulnerability/PT-2026-89907 • https://github.com/faceless0x7/cve-2026-89013

    Post summary

    A PoC/exploit for CVE-2026-89013 affecting Dolibarr versions before 24.0.1 has been disclosed, with a GitHub repository providing the exploit code. The vulnerability is an authorization bypass allowing unauthenticated file read via the hashp parameter.

    02041799
    3.7K followersView on X
  • Previdian@PrevidianCyber
    Active Exploitation

    Two new KEVs sighted by Previdian sensors today. • CVE-2026-89013: Dolibarr auth bypass • CVE-2026-86538: knowns path traversal Our honeypots first saw exploitation attempts on Sept 14–15, with a sharp rise today 🚀 Both recently patched. Added to our KEV feed. https://t.co/sbPVYm0VIR

    Post summary

    The text reports two vulnerabilities added to the KEV feed that are actively being exploited in the wild, with a sharp increase in recent attack attempts, and notes that patches have already been released.

    11022194
    178 followersView on X
  • pdnuclei-bot@pdnuclei_bot
    PoC

    🚨 CVE-2026-89013 - high 🚨 Dolibarr < 24.0.0 - Authorization Bypass via hashp Parameter > Dolibarr ERP/CRM versions 23.0.4 through 24.0.0 contain an authorization bypass vulne... 👾 https://cloud.projectdiscovery.io/library/CVE-2026-89013 @pdnuclei #NucleiTemplates #cve

    Post summary

    The tweet announces CVE-2026-89013 in Dolibarr, highlighting an authorization bypass vulnerability and links to a Nuclei template resource, which implies a PoC or detection methodology.

    00001272
    1.3K followersView on X
  • Hephaestvs@Vulcanux_
    Active Exploitation

    csirt_it: ‼️ #Exploited #Dolibarr: rilevato sfruttamento attivo in rete della CVE-2026-89013 Rischio: 🔴 Tipologia: 🔸 Arbitrary File Read 🔗 https://www.acn.gov.it/portale/w/dolibarr-rilevato-sfruttamento-in-rete-della-cve-2026-89013 ⚠️ Importante mantenere aggiornati i sistemi https://t.co/GHQDsTSwSJ

    Post summary

    The Italian CSIRT reports that CVE‑2026‑89013 is being actively exploited in the wild as an arbitrary file read vulnerability. While it urges keeping systems updated, it does not provide a specific patch reference.

    0000030
    643 followersView on X

Explore more

Back to dashboard