Vulnerability Description
Dolibarr ERP CRM before 24.0.2 contains a missing authorization vulnerability in htdocs/public/recruitment/view.php that allows unauthenticated attackers to view unpublished draft job positions. Attackers can enumerate sequential provisional references via the ref parameter to read titles, descriptions, salary budgets, and recruiter names and emails.
CVSS Score
MEDIUM
Related Weaknesses (CWE)
References
- https://github.com/Dolibarr/dolibarr
- https://github.com/Dolibarr/dolibarr/blob/24.0.1/htdocs/public/recruitment/view.
- https://github.com/Dolibarr/dolibarr/commit/f4ee5e9722c7ae04bf22a4afff8d8b91802d
- https://github.com/Dolibarr/dolibarr/pull/41108
- https://www.vulncheck.com/advisories/dolibarr-erp-crm-before-24.0.2-missing-auth
FAQ
What is CVE-2026-118754?
CVE-2026-118754 is a vulnerability with a CVSS score of 5.3 (MEDIUM). Dolibarr ERP CRM before 24.0.2 contains a missing authorization vulnerability in htdocs/public/recruitment/view.php that allows unauthenticated attackers to view unpublished draft job positions. Attac...
How severe is CVE-2026-118754?
CVE-2026-118754 has been rated MEDIUM with a CVSS base score of 5.3/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2026-118754?
Check the references section above for vendor advisories and patch information. Review vendor security bulletins for remediation guidance.