What’s Vulnerable › Vulnerabilities

CVE-2026-118754: Dolibarr ERP CRM before 24.0.2 Missing Authorization via public recruitment view.php

• Severity: medium (CVSS 5.3 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.2% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-10-28 · updated 2026-10-29
• Weakness: CWE-862

Description

Dolibarr ERP CRM before 24.0.2 contains a missing authorization vulnerability in htdocs/public/recruitment/view.php that allows unauthenticated attackers to view unpublished draft job positions. Attackers can enumerate sequential provisional references via the ref parameter to read titles, descriptions, salary budgets, and recruiter names and emails.

Affected products

• dolibarr: before 24.0.2 — fixed in 24.0.2

How to fix

Upgrade to a fixed version: dolibarr 24.0.2. Check the vendor advisory for mitigations.

References

• https://github.com/Dolibarr/dolibarr
• https://github.com/Dolibarr/dolibarr/blob/24.0.1/htdocs/public/recruitment/view.php#L106
• https://github.com/Dolibarr/dolibarr/commit/f4ee5e9722c7ae04bf22a4afff8d8b91802d8157
• https://github.com/Dolibarr/dolibarr/pull/41108
• https://www.vulncheck.com/advisories/dolibarr-erp-crm-before-24.0.2-missing-authorization-via-public-recruitment-view-php

Get alerted when CVE-2026-118754 or the next vulnerability affects your stack