CVE-2026-89012
Dolibarr 24.0.0 before 24.0.1 contains a case-sensitive denylist bypass vulnerability in the sqlfilters API query parameter that allows authenticated attackers to recover protected database fields by supplying uppercase variants of denylist-protected field names. Attackers can exploit the case-insensitive database column resolution against the case-sensitive denylist check in the core library to use prefix-matching predicates as a boolean oracle and extract full password hashes for any user account, including administrators.
Scoring
- Severity
- HIGH
- CVSS base score
- 7.1
- CVSS vector
- CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
- EPSS probability
- 0.34%
- CWE
- CWE-178
- Published
- 2026-09-11
- Last modified
- 2026-09-11
Affected products
- Dolibarr Dolibarr
Weakness type
Related vulnerabilities
- CVE-2023-3545 — Chamilo LMS Htaccess File Upload Security Bypass
- CVE-2023-4759 — Improper handling of case insensitive filesystems in Eclipse JGit allows arbitrary file write
- CVE-2025-46701 — Apache Tomcat: Security constraint bypass for CGI scripts
- CVE-2026-43513 — Apache Tomcat: LockOutRealm treats user names as case-sensitive
- CVE-2025-67718 — Formio improperly authorized permission elevation through specially crafted request path
- CVE-2026-40453 — Apache Camel JMS, Apache Camel CoAP, Apache Camel Google PubSub: Incomplete fix for CVE-2025-27636 in non-HTTP HeaderFilterStrategies (camel-jms, camel-sjms, camel-coap, camel-google-pubsub) allows case-variant header injection
- CVE-2021-39155 — Authorization Policy Bypass Due to Case Insensitive Host Comparison
- CVE-2026-47323 — Apache Camel: Camel-CXF Message Header Injection via Missing Inbound Filtering