EUVD-2026-125757

Dolibarr before 24.0.2 contains an insecure direct object reference vulnerability in the REST Documents API for the ticket module that allows authenticated API users to access ticket attachments belonging to other companies by omitting a company-scope check that is only applied via a session...

CVE-2026-89037

Dolibarr versions prior to 24.0.2 are vulnerable to an Insecure Direct Object Reference (IDOR) in the REST Documents API for the ticket module. The root cause is a missing company-scope check during API authentication, as the required session variable is only set during public ticket authenticati...