Medium 6.9

Dolibarr ERP CRM before 24.0.2 contains a missing authorization vulnerability in htdocs/public...

CVE-2026-118754 First seen on SecPulse 06:11

Affected packages

Ecosystem	Package	Affected	Fixed
Dolibarr	Dolibarr ERP/CRM	< 24.0.2	24.0.2

Original description The description as published by the source.

Dolibarr ERP CRM before 24.0.2 contains a missing authorization vulnerability in htdocs/public/recruitment/view.php that allows unauthenticated attackers to view unpublished draft job positions. Attackers can enumerate sequential provisional references via the ref parameter to read titles, descriptions, salary budgets, and recruiter names and emails.

Source: CVE.org (CVE Program・cvelistV5) NVD GitHub Advisory

References

Key facts

CVSS v3: Medium 5.3; CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
CVSS v4: Medium 6.9; CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N
Published: Oct 29, 2026
First seen on SecPulse: 06:11
GHSA: GHSA-jpqr-vpm2-xhh4
CWE: CWE-862

NVD GitHub Advisory

Tags(click for explanation)

Programming Languages

PHP

CWE

CWE-862

All

Dolibarr Dolibarr Erpcrm

Detection sources

NIST National Vulnerability Database07:17
GitHub Security Advisories (Global)09:31
CVE.org (CVE Program・cvelistV5)06:11