CVE-2026-118754

medium

Description

Dolibarr ERP CRM before 24.0.2 contains a missing authorization vulnerability in htdocs/public/recruitment/view.php that allows unauthenticated attackers to view unpublished draft job positions. Attackers can enumerate sequential provisional references via the ref parameter to read titles, descriptions, salary budgets, and recruiter names and emails.

References

https://www.vulncheck.com/advisories/dolibarr-erp-crm-before-24.0.2-missing-authorization-via-public-recruitment-view-php

https://github.com/Dolibarr/dolibarr/pull/41108

https://github.com/Dolibarr/dolibarr/commit/f4ee5e9722c7ae04bf22a4afff8d8b91802d8157

https://github.com/Dolibarr/dolibarr/blob/24.0.1/htdocs/public/recruitment/view.php#L106

https://github.com/Dolibarr/dolibarr

https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-112498

Details

Source: Mitre, NVD

Published: 2026-10-28

Updated: 2026-10-29

Risk Information

CVSS v2

Base Score: 5

Vector: CVSS2#AV:N/AC:L/Au:N/C:P/I:N/A:N

Severity: Medium

CVSS v3

Base Score: 5.3

Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Severity: Medium

CVSS v4

Base Score: 6.9

Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

Severity: Medium

EPSS

EPSS: 0.00239