Skip to content
OpenAdvisories
Medium · 6.5 Public exploit CVE-2026-89012 EUVD-2026-76141GHSA-vhvr-3m2v-rrfq

Dolibarr 24.0.0 < 24.0.1 SQL Filter Denylist Bypass via sqlfilters Parameter

Published Sep 11, 2026 · Updated Oct 1, 2026 · Assigned by VulnCheck

Vendor: Dolibarr Product: dolibarr

Description

Dolibarr 24.0.0 before 24.0.1 contains a case-sensitive denylist bypass vulnerability in the sqlfilters API query parameter that allows authenticated attackers to recover protected database fields by supplying uppercase variants of denylist-protected field names. Attackers can exploit the case-insensitive database column resolution against the case-sensitive denylist check in the core library to use prefix-matching predicates as a boolean oracle and extract full password hashes for any user account, including administrators.

Affected products

VendorProductAffectedFixed
Dolibarr Dolibarr 24.0.0 – < 24.0.1 24.0.1

Public exploits

Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.

Third-party code, not reviewed by us. Public PoCs are sometimes fake or contain malware. Read the code first and run it only in an isolated lab, against systems you are authorised to test.

GitHub 1 repository

  • Faceless0x7/CVE-2026-89012 ★ 6 · Sep 11, 2026

    CVE-2026-89012 Exploit — SQL filter denylist bypass in Dolibarr via case-insensitive SQL column resolution and case-sensitive denylist matching.

Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.

References