Medium 5.3Published Oct 28, 2026

CVE-2026-118754Dolibarr ERP CRM before 24.0.2 Missing Authorization via public recruitment view.php

Updated under an hour ago (Oct 29, 2026, 10:23 PM ET)

Does this affect you?

It affects Dolibarr ERP/CRM. Add what you run to find out whether that includes you.

No exploitation reported and no EPSS estimate yet.

Do this next

Start free and add your stackFree account, 3 products Every CVE for Dolibarr ERP/CRM Exploited in the last 30 days

Dolibarr ERP CRM before 24.0.2 contains a missing authorization vulnerability in htdocs/public/recruitment/view.php that allows unauthenticated attackers to view unpublished draft job positions. Attackers can enumerate sequential provisional references via the ref parameter to read titles, descriptions, salary budgets, and recruiter names and emails.

CVSS: 5.3 MEDIUM (v3.1, CNA)CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Weakness (CWE): CWE-862
Known exploited: Not in CISA's KEV catalog
EPSS (exploitation in the next 30 days): Not loaded for this CVE
Assigned by: VulnCheck
NVD analysis: Awaiting Analysis
Record last updated: Oct 28, 2026
First seen by InfoSec Signals: Oct 28, 2026

Affected products

Affected products

Dolibarr Dolibarr ERP/CRM dolibarr:erp_crm (from the name)	before 24.0.2	CNA record

References

References

https://github.com/Dolibarr/dolibarr/pull/41108	issue-tracking, patch
https://github.com/Dolibarr/dolibarr/commit/f4ee5e9722c7ae04bf22a4afff8d8b91802d8157	patch
https://github.com/Dolibarr/dolibarr	product
https://github.com/Dolibarr/dolibarr/blob/24.0.1/htdocs/public/recruitment/view.php#L106	technical-description
https://www.vulncheck.com/advisories/dolibarr-erp-crm-before-24.0.2-missing-authorization-via-public-recruitment-view-php	third-party-advisory

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.