CVE-2026-118754
Dolibarr ERP CRM before 24.0.2 Missing Authorization via public recruitment view.php
Dolibarr Dolibarr ERP/CRM
CVSS
6.9MediumExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)No scoreNo FIRST EPSS score in this snapshot yet
What fixes it
- 24.0.2Dolibarr ERP/CRMCVE List
A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.
Description
Dolibarr ERP CRM before 24.0.2 contains a missing authorization vulnerability in htdocs/public/recruitment/view.php that allows unauthenticated attackers to view unpublished draft job positions. Attackers can enumerate sequential provisional references via the ref parameter to read titles, descriptions, salary budgets, and recruiter names and emails.
Text from CVE List
Affected versions 1
- Dolibarr ERP/CRMaffected: all versions before 24.0.2CVE List
References 5
- github.com/Dolibarr/dolibarr/pull/41108Fixvia CVE List
- github.com/Dolibarr/dolibarr/commit/f4ee5e9722c7ae04bf22a4afff8d8b91802d8157Fixvia CVE List
- vulncheck.com/advisories/dolibarr-erp-crm-before-24.0.2-missing-authorization-via-public-recruitment-view-phpAdvisoryvia CVE List
- github.com/Dolibarr/dolibarrReferencevia CVE List
- github.com/Dolibarr/dolibarr/blob/24.0.1/htdocs/public/recruitment/view.php#L106Referencevia CVE List