CVE-2026-118754
Dolibarr ERP CRM before 24.0.2 Missing Authorization via public recruitment view.php
- State
- Published
- Severity
- 6.9 Medium
- Published
- Oct 28, 2026
- Updated
- Oct 28, 2026
- Reserved
- Oct 28, 2026
Description
Dolibarr ERP CRM before 24.0.2 contains a missing authorization vulnerability in htdocs/public/recruitment/view.php that allows unauthenticated attackers to view unpublished draft job positions. Attackers can enumerate sequential provisional references via the ref parameter to read titles, descriptions, salary budgets, and recruiter names and emails.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 4.0 | 6.9 Medium | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N | VulnCheck |
| 3.1 | 5.3 Medium | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N | VulnCheck |
Weaknesses
- CWE-862 Missing Authorization
Affected Products
| Product | Versions |
|---|---|
Dolibarr ERP/CRMDolibarr |
|
References
- Pull Request #41108issue-trackingpatch
- Patch Commitpatch
- https://github.com/Dolibarr/dolibarrproduct
- https://github.com/Dolibarr/dolibarr/blob/24.0.1/htdocs/public/recruitment/view.php#L106technical-description
- VulnCheck Advisory: Dolibarr ERP CRM before 24.0.2 Missing Authorization via public recruitment view.phpthird-party-advisory
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.