Vulnerability · Published Oct 28, 2026 · Assigned by VulnCheck
CVE-2026-118754Dolibarr ERP CRM before 24.0.2 Missing Authorization via public recruitment view.php
Medium 5.3
In plain English
A medium-severity missing authorization in Dolibarr ERP/CRM from Dolibarr. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 15% of all known vulnerabilities).
Severity (CVSS 3.1)5.3Medium
Exploit odds (30 days)0.2%top 84.9% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known
Official description
Dolibarr ERP CRM before 24.0.2 contains a missing authorization vulnerability in htdocs/public/recruitment/view.php that allows unauthenticated attackers to view unpublished draft job positions. Attackers can enumerate sequential provisional references via the ref parameter to read titles, descriptions, salary budgets, and recruiter names and emails.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Dolibarr | Dolibarr ERP/CRM | 0 – before 24.0.2 |
Weakness: CWE-862 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
References
- Pull Request #41108 issue-tracking, patch
- Patch Commit patch
- https://github.com/Dolibarr/dolibarr product
- https://github.com/Dolibarr/dolibarr/blob/24.0.1/htdocs/public/recruitment/view.php#L106 technical-description
- VulnCheck Advisory: Dolibarr ERP CRM before 24.0.2 Missing Authorization via public recruitment view.php third-party-advisory