CVE-2026-89012

COMPONENT VERSION RANGE

NewScan fingerprints Dolibarr from its response and reports this CVE when the detected version falls inside the affected range below.

Added 2026-09-13. CVSS 7.1 (v4) / 6.5 (v3.1), and the v3.1 band is what sets `medium` here per docs/severity-standard.md - PR:L, so unlike its 89013 sibling this one needs an account. The core library's denylist of protected field names is compared case-SENSITIVELY while the database resolves column names case-INSENSITIVELY, so `PASS_CRYPTED` reaches the column `pass_crypted` the denylist was written to protect; prefix-matching predicates then turn the API into a boolean oracle that extracts full password hashes for any user including administrators. A SEPARATE row from CVE-2026-89013 rather than one merged `lt 24.0.1`, because the two have different lower bounds - 89013 reaches back to 23.0.4 and this one starts at 24.0.0 - so a merged row would claim this id against a 23.x install that never had it. The accepted cost is that a 24.0.0 install reports both; both are true and both resolve to the same upgrade. Version-match only: the oracle is authenticated and extracting a hash to prove it is not something a scanner may do to a customer. Same version source and same live measurement as the 89013 row above - dolibarr/dolibarr 24.0.0 on loopback is inside this range too and is the affected arm; no 24.0.1 image exists to measure the patched side, so 24.0.1 is fixture-pinned on both sides.