CVE-2026-118754EUVD-2026-112498GHSA-JPQR-VPM2-XHH4
Dolibarr ERP CRM before 24.0.2 Missing Authorization via public recruitment view.php
- Published
- Last modified
- Where the record stands: published, rejected by its publisher, or superseded by another id.What do these mean? →
- published
- Whether CISA lists it in its Known Exploited Vulnerabilities catalog: proof that attackers are using it.What do these mean? →
- Not listed in CISA KEV
- Fix
- Fixed in 24.0.2
- Whether working attack code is public (Exploit-DB, Metasploit, Nuclei or GitHub). Public code makes attacks easier.What do these mean? →
- None on Exploit-DB, Metasploit or GitHub
Summary
Dolibarr ERP/CRM, an open-source business management application, is affected by this flaw. Unauthenticated users can access unpublished draft job postings and view their details, including salary budgets and recruiter contact information.
Summarized by anthropic/claude-haiku-5.5. Verify details against the original sources.
Read the original description
Dolibarr ERP CRM before 24.0.2 contains a missing authorization vulnerability in htdocs/public/recruitment/view.php that allows unauthenticated attackers to view unpublished draft job positions. Attackers can enumerate sequential provisional references via the ref parameter to read titles, descriptions, salary budgets, and recruiter names and emails.
Timeline
- CVE published
- First seen by cve.now
Affected versions
- Dolibarr Dolibarr ERP/CRM
fixed in 24.0.2