{"id":"CVE-2026-118754","kind":"vulnerability","aliases":["CVE-2026-118754"],"related":[],"title":"Dolibarr ERP CRM: unauthenticated users can read unpublished job drafts","description":"Dolibarr ERP CRM before 24.0.2 contains a missing authorization vulnerability in htdocs/public/recruitment/view.php that allows unauthenticated attackers to view unpublished draft job positions. Attackers can enumerate sequential provisional references via the ref parameter to read titles, descriptions, salary budgets, and recruiter names and emails.","summary":"Dolibarr ERP CRM before 24.0.2 exposes unpublished draft job positions through the public recruitment page htdocs/public/recruitment/view.php without authorization. An unauthenticated attacker can enumerate sequential provisional references to read job titles, descriptions, salary budgets, and recruiter names and emails.","severity":"medium","cvss":6.9,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["dolibarr","hr","package","php","self-hosted"],"not_affected_if":["default-config","managed-hosting"],"how_to_check":"- Check the installed Dolibarr version; `24.0.2` or later is not affected, anything earlier is.\n- Look for `htdocs/public/recruitment/view.php` in the installation and confirm whether the public recruitment module is reachable from the internet.\n- Request the public recruitment page with a sequential `ref` value while logged out and see whether draft positions are returned.","fix":"- Upgrade Dolibarr to `24.0.2` or later.\n- Until upgraded, disable or block public access to the recruitment pages if the public recruitment feature is not needed.","status":"open","published_at":"2026-10-28T22:17:14+00:00","first_seen_at":"2026-10-28T22:35:34+00:00","triaged_at":"2026-10-28T22:36:54+00:00","updated_at":"2026-10-28T22:36:54+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-10-28T22:36:54Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade Dolibarr to `24.0.2` or later.\n- Until upgraded, disable or block public access to the recruitment pages if the public recruitment feature is not needed.","reach":"internet","title":"Dolibarr ERP CRM: unauthenticated users can read unpublished job drafts","impact":"medium","summary":"Dolibarr ERP CRM before 24.0.2 exposes unpublished draft job positions through the public recruitment page htdocs/public/recruitment/view.php without authorization. An unauthenticated attacker can enumerate sequential provisional references to read job titles, descriptions, salary budgets, and recruiter names and emails.","category":"package","nicknames":[],"who_cares":["dolibarr","self-hosted","hr","php"],"confidence":0.7,"needs_auth":"no","worst_case":"Unauthenticated readers obtain draft job data and recruiter contact details.","analyst_note":"","how_to_check":"- Check the installed Dolibarr version; `24.0.2` or later is not affected, anything earlier is.\n- Look for `htdocs/public/recruitment/view.php` in the installation and confirm whether the public recruitment module is reachable from the internet.\n- Request the public recruitment page with a sequential `ref` value while logged out and see whether draft positions are returned.","needs_analyst":false,"not_affected_if":["managed-hosting","default-config"],"who_is_affected":"Teams running self-hosted Dolibarr ERP CRM before 24.0.2 that expose the public recruitment page to the internet. Installations that do not use the public recruitment feature or keep it behind a network restriction have a much smaller exposure.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"medium"},"cost_usd":0.000641,"input_tokens":3352,"output_tokens":612,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-118754':13A,16A '-2026':12A,15A '24.0.2':28B,66C 'allow':75C 'attack':44B,77C,84C 'author':41B,70C 'budget':56B,99C 'contain':67C 'crm':3A,26B,64C 'cve':11A,14A 'descript':54B,97C 'dolibarr':1A,17B,24B,62C 'draft':10A,31B,81C 'email':61B,104C 'enumer':46B,86C 'erp':2A,25B,63C 'expos':29B 'host':23B 'hr':18B 'htdocs/public/recruitment/view.php':39B,73C 'job':9A,32B,52B,82C 'miss':69C 'name':59B,102C 'packag':19B 'page':38B 'paramet':93C 'php':20B 'posit':33B,83C 'provision':48B,88C 'public':36B 'read':7A,51B,95C 'recruit':37B,58B,101C 'ref':92C 'refer':49B,89C 'salari':55B,98C 'self':22B 'self-host':21B 'sequenti':47B,87C 'titl':53B,96C 'unauthent':4A,43B,76C 'unpublish':8A,30B,80C 'user':5A 'via':90C 'view':79C 'vulner':71C 'without':40B","nicknames":[],"mitigations":[],"who_affected":"Teams running self-hosted Dolibarr ERP CRM before 24.0.2 that expose the public recruitment page to the internet. Installations that do not use the public recruitment feature or keep it behind a network restriction have a much smaller exposure.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-28T22:17:14+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-118754","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-118754","severity":null,"published_at":"2026-10-28T22:17:14+00:00","modified_at":"2026-10-28T22:17:14+00:00","first_seen_at":"2026-10-28T22:35:34+00:00","fetched_at":"2026-10-28T22:35:34+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}