CVE-2026-89012 Details

A case-sensitive denylist bypass vulnerability has been identified in Dolibarr versions 24.0.0 prior to 24.0.1. This vulnerability resides in the sqlfilters API query parameter, where authenticated attackers can exploit the case sensitivity of denylist-protected field names. By supplying uppercase variants of these field names, attackers can bypass the denylist and access protected database fields. The exploitation takes advantage of the case-insensitive resolution of database columns, allowing attackers to use prefix-matching predicates as a boolean oracle to extract full password hashes from any user account, including those of administrators.

Users can upgrade to Dolibarr version 24.0.1 to address this vulnerability.