Description

Dolibarr 23.0.4 before 24.0.1 ontains an authorization bypass vulnerability that allows unauthenticated attackers to read arbitrary files through the document storage endpoints by supplying a crafted hashp parameter value. Attackers can send a request with hashp=shared to skip token validation while satisfying the authorization condition in htdocs/document.php and htdocs/viewimage.php, gaining access to application logs, uploaded business documents, database backups containing password hashes, and files belonging to other multicompany entities.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.5",
  "pubDate": "2026-09-11T16:17:48.853Z",
  "pubdate": "2026-09-11T16:17:48.853Z",
  "executiveSummary": "Dolibarr versions 23.0.4 through 24.0.0 contain an authorization bypass vulnerability residing within the application's document storage management system.\nThe vulnerability is classified as an improper authorization mechanism, allowing unauthenticated remote attackers to bypass security controls and perform unauthorized file reads.\nBy manipulating the 'hashp' parameter in specific document retrieval endpoints, an attacker can circumvent token-based access validation.\nThe impact is critical, as it facilitates unauthorized access to sensitive system information, including application logs, uploaded business documentation, and database backups containing password hashes.\nIn multi-tenant (multicompany) configurations, this flaw permits cross-entity data leakage, granting an attacker access to files belonging to other logical instances.\nThe risk is severe due to the ease of exploitation, as it requires no prior authentication or administrative privileges, exposing the application to data exfiltration and potential total system compromise.",
  "technicalDetails": "The vulnerability stems from flawed logic in the document retrieval and image viewing modules within Dolibarr, specifically located in 'htdocs/document.php' and 'htdocs/viewimage.php'.\nThe application employs a security mechanism intended to validate requests for files via a token-based authentication scheme. However, the logic responsible for validating these tokens can be bypassed by supplying a specific value to the 'hashp' parameter.\nWhen an attacker sets 'hashp=shared', the underlying validation logic erroneously flags the request as meeting the internal authorization requirements, causing the system to skip the token verification process entirely.\nBecause the 'hashp' parameter dictates how the application identifies and authorizes the requested file path, supplying 'shared' instructs the server to treat the request as a public or pre-authorized access attempt.\nThe attack flow proceeds as follows: 1) The attacker identifies a target Dolibarr instance; 2) The attacker constructs a crafted HTTP request to either 'htdocs/document.php' or 'htdocs/viewimage.php'; 3) The attacker injects the malicious 'hashp=shared' parameter while providing a path to a sensitive file (e.g., ../../documents/database.sql or ../../documents/logs/dolibarr.log); 4) The application, having skipped the token check due to the manipulated parameter, processes the file path directly and returns the contents of the requested file to the attacker.\nThis vulnerability is particularly dangerous because it does not rely on local file inclusion (LFI) path traversal limitations alone but rather on the total failure of the authorization layer. Once access is gained, an attacker can enumerate and download arbitrary files from the server's filesystem.\nThe scope of impact extends beyond a single installation in multi-company environments. Because the authorization logic is flawed, the attacker can traverse between different company data directories, effectively breaking the logical isolation provided by the multi-company module.\nThe exposure is global to any network-reachable instance of the vulnerable versions. The lack of requirement for authentication makes this an trivial exploit for remote actors looking to harvest sensitive credentials or proprietary business intelligence."
}