CVE-2026-118754: Dolibarr ERP CRM before 24.0.2 Missing Authorization via public recruitment view.php
Dolibarr ERP CRM before 24.0.2 contains a missing authorization vulnerability in htdocs/public/recruitment/view.php that allows unauthenticated attackers to view unpublished draft job positions. Attackers can enumerate sequential provisional references via the ref parameter to read titles, descriptions, salary budgets, and recruiter names and emails.
Affected Software
Event History
Frequently Asked Questions
Which deployments are exposed?
Dolibarr ERP CRM deployments running a version before 24.0.2 are affected if the public recruitment view endpoint is reachable. The exposed endpoint is htdocs/public/recruitment/view.php.
What does an attacker need to exploit this issue?
No authentication or user interaction is required. An attacker can enumerate sequential provisional references supplied through the ref parameter.
What information can be disclosed?
An attacker can view unpublished draft job positions, including job titles, descriptions, salary budgets, and recruiter names and email addresses.
How can I determine whether draft positions may already be exposed?
Review access to the public recruitment view endpoint and assess whether requests using sequential ref values returned unpublished draft job postings. Check whether the affected endpoint was publicly reachable on versions before 24.0.2.