{"id":"CVE-2026-89012","title":"Dolibarr 24.0.0 before 24.0.1 contains a case-sensitive denylist bypass vulnerability in the sqlfilters API query parameter that allows authenticated attackers to recover protected database fields by supplying uppercase variants of denyl…","summary":"Dolibarr 24.0.0 before 24.0.1 contains a case-sensitive denylist bypass vulnerability in the sqlfilters API query parameter that allows authenticated attackers to recover protected database fields by supplying uppercase variants of denyl…","severity":"medium","cvss":6.5,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","cwe":["CWE-178"],"vendor":"Dolibarr","product":"Dolibarr","affected":["Dolibarr >= 24.0.0 < 24.0.1"],"published":"2026-09-11","updated":"2026-09-23","sourceUpdated":"2026-09-23T17:17:46.343","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-89012","references":[{"url":"https://github.com/Dolibarr/dolibarr/commit/7a04d9c970e45e15d29c91e6f5a34a262c6c51c8","label":"disclosure@vulncheck.com"},{"url":"https://github.com/Dolibarr/dolibarr/releases/tag/24.0.1","label":"disclosure@vulncheck.com"},{"url":"https://www.vulncheck.com/advisories/dolibarr-sql-filter-denylist-bypass-via-sqlfilters-parameter","label":"disclosure@vulncheck.com"}],"tags":["nvd","exploit-available","cve.org"],"epss":0.00339,"epssPercentile":0.27442,"exploits":{"github":1,"githubRepos":["https://github.com/Faceless0x7/CVE-2026-89012"],"checkedAt":"2026-09-23T17:28:48.970Z"},"exploitAvailable":true,"ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"partial","timestamp":"2026-09-11T19:16:46.359635Z"},"ingestedAt":"2026-09-14T00:35:28.534Z","slug":"CVE-2026-89012","body":"## Overview\n\nDolibarr 24.0.0 before 24.0.1 contains a case-sensitive denylist bypass vulnerability in the sqlfilters API query parameter that allows authenticated attackers to recover protected database fields by supplying uppercase variants of denylist-protected field names. Attackers can exploit the case-insensitive database column resolution against the case-sensitive denylist check in the core library to use prefix-matching predicates as a boolean oracle and extract full password hashes for any user account, including administrators.\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"twilight","depthScore":48,"depthScoreParts":{"impact":35.8,"likelihood":0.1,"exploitation":12,"ransomware":0},"changes":[]}