CVE-2026-89013

{
  "etk_id": "ETK-2026-499",
  "cve_id": "CVE-2026-89013",
  "display_id": "CVE-2026-89013",
  "ghsa_id": "GHSA-fm6p-42mr-x6jm",
  "euvd_id": "EUVD-2026-76144",
  "status": "published",
  "anchor_state": "anchored",
  "title": "Authorization bypass in Dolibarr document storage endpoints",
  "summary": "Dolibarr versions before 24.0.1 contain an authorization bypass affecting document storage endpoints. An unauthenticated attacker may read files exposed through those endpoints, including uploaded documents, logs, and backup data, when they can make a request that meets the flawed authorization condition.",
  "mitigation": "Upgrade Dolibarr to version 24.0.1 or later. Until upgrade is complete, restrict network access to the affected document endpoints to trusted users and networks.",
  "vendor": "dolibarr",
  "product": "dolibarr_erp\\/crm",
  "affected": [
    {
      "affected_notes": [],
      "affected_ranges": [
        ">= 23.0.4, < 24.0.1"
      ],
      "ecosystem": null,
      "fixed_versions": [
        "24.0.1"
      ],
      "package_name": "Dolibarr",
      "purl": null
    }
  ],
  "cwes": [
    863
  ],
  "cvss_score": 7.5,
  "cvss_src": "nvd",
  "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
  "epss_score": 0.0156,
  "epss_percentile": 0.7489,
  "epss_asof": "2026-10-20",
  "automation": "deterministic",
  "check": true,
  "check_confidence_basis": "upstream",
  "exploit": false,
  "pipeline_minutes": 0.0112876,
  "t0_at": "2026-09-11T15:54:59.282000+00:00",
  "signals": {
    "check": {
      "at": "2026-10-03T21:00:45.121665+00:00",
      "days": 22.212336107233796,
      "is_lower_bound": false,
      "measured_at": "2026-09-11T15:54:59.282000+00:00",
      "url": null
    },
    "kev": {
      "at": "2026-09-17T00:00:00+00:00",
      "days": 6,
      "is_lower_bound": false,
      "measured_at": "2026-09-11T15:54:59.282000+00:00",
      "precision": "day",
      "url": "https://vulncheck.com/cve/CVE-2026-89013"
    },
    "public_poc": {
      "at": "2026-10-03T21:00:45.168718+00:00",
      "days": 22.212336651828704,
      "is_lower_bound": false,
      "measured_at": "2026-09-11T15:54:59.282000+00:00",
      "url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-89013.yaml"
    },
    "trigger_signal": {
      "at": "2026-09-17T00:00:00+00:00",
      "days": 5.336813865740741,
      "is_lower_bound": false,
      "measured_at": "2026-09-11T15:54:59.282000+00:00",
      "url": "https://vulncheck.com/cve/CVE-2026-89013"
    }
  }
}