---
id: CVE-2026-118754
title: >-
  Dolibarr ERP CRM before 24.0.2 Missing Authorization via public recruitment
  view.php
summary: >-
  Dolibarr ERP CRM before 24.0.2 contains a missing authorization vulnerability
  in htdocs/public/recruitment/view.php that allows unauthenticated attackers to
  view unpublished draft job positions. Attackers can enumerate sequential
  provisi…
severity: medium
cvss: 5.3
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N'
cvssSource: cna
cwe:
  - CWE-862
vendor: Dolibarr
product: Dolibarr ERP/CRM
affected:
  - erp_crm < 24.0.2
ssvc:
  exploitation: poc
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-11-03T13:41:58.818424Z'
exploitAvailable: true
published: '2026-10-28'
updated: '2026-11-03'
sourceUpdated: '2026-11-03T13:42:30.860Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-118754'
references:
  - url: 'https://github.com/Dolibarr/dolibarr/pull/41108'
    label: 'Pull Request #41108'
  - url: >-
      https://github.com/Dolibarr/dolibarr/commit/f4ee5e9722c7ae04bf22a4afff8d8b91802d8157
    label: Patch Commit
  - url: 'https://github.com/Dolibarr/dolibarr'
  - url: >-
      https://github.com/Dolibarr/dolibarr/blob/24.0.1/htdocs/public/recruitment/view.php#L106
  - url: >-
      https://www.vulncheck.com/advisories/dolibarr-erp-crm-before-24.0.2-missing-authorization-via-public-recruitment-view-php
    label: >-
      VulnCheck Advisory: Dolibarr ERP CRM before 24.0.2 Missing Authorization
      via public recruitment view.php
tags:
  - cve.org
  - exploit-available
epss: 0.00239
epssPercentile: 0.15107
ingestedAt: '2026-10-30T21:09:21.617Z'
---

## Overview

Dolibarr ERP CRM before 24.0.2 contains a missing authorization vulnerability in htdocs/public/recruitment/view.php that allows unauthenticated attackers to view unpublished draft job positions. Attackers can enumerate sequential provisional references via the ref parameter to read titles, descriptions, salary budgets, and recruiter names and emails.

## Affected

- `erp_crm < 24.0.2`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.