Dolibarr Incorrect Authorization Vulnerability - CVE-2026-89013

Dolibarr 23.0.4 before 24.0.1 contains an authorization bypass vulnerability that allows unauthenticated attackers to read arbitrary files through the document storage endpoints by supplying a crafted hashp parameter value. Attackers can send a request with hashpshared to skip token validation while satisfying the authorization condition in htdocs/document.php and htdocs/viewimage.php gaining access to application logs uploaded business documents database backups containing password hashes