Live › vulnerability › CVE-2026-118754
Go to dashboardDolibarr ERP CRM before 24.0.2 exposes unpublished draft job positions through the public recruitment page htdocs/public/recruitment/view.php without authorization. An unauthenticated attacker can enumerate sequential provisional references to read job titles, descriptions, salary budgets, and recruiter names and emails.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-28 22:35 UTC. All times on this page are UTC.
Teams running self-hosted Dolibarr ERP CRM before 24.0.2 that expose the public recruitment page to the internet. Installations that do not use the public recruitment feature or keep it behind a network restriction have a much smaller exposure.
No product ranges from the sources yet.
24.0.2 or later is not affected, anything earlier is.htdocs/public/recruitment/view.php in the installation and confirm whether the public recruitment module is reachable from the internet.ref value while logged out and see whether draft positions are returned.24.0.2 or later.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Dolibarr ERP CRM before 24.0.2 contains a missing authorization vulnerability in htdocs/public/recruitment/view.php that allows unauthenticated attackers to view unpublished draft job positions. Attackers can enumerate sequential provisional references via the ref parameter to read titles, descriptions, salary budgets, and recruiter names and emails.
This page as .md · .json · in your agent: get_signal("CVE-2026-118754")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.