---
id: "CVE-2026-118754"
kind: "vulnerability"
aliases: ["CVE-2026-118754"]
title: "Dolibarr ERP CRM: unauthenticated users can read unpublished job drafts"
severity: "medium"
cvss: 6.9
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["dolibarr", "hr", "package", "php", "self-hosted"]
not_affected_if: ["default-config", "managed-hosting"]
published_at: "2026-10-28T22:17:14+00:00"
first_seen_at: "2026-10-28T22:35:34+00:00"
updated_at: "2026-10-28T22:36:54+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-118754", "first_seen_at": "2026-10-28T22:35:34+00:00"}]
---

# Dolibarr ERP CRM: unauthenticated users can read unpublished job drafts

Dolibarr ERP CRM before 24.0.2 exposes unpublished draft job positions through the public recruitment page htdocs/public/recruitment/view.php without authorization. An unauthenticated attacker can enumerate sequential provisional references to read job titles, descriptions, salary budgets, and recruiter names and emails.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed Dolibarr version; `24.0.2` or later is not affected, anything earlier is.
- Look for `htdocs/public/recruitment/view.php` in the installation and confirm whether the public recruitment module is reachable from the internet.
- Request the public recruitment page with a sequential `ref` value while logged out and see whether draft positions are returned.

## Fix

- Upgrade Dolibarr to `24.0.2` or later.
- Until upgraded, disable or block public access to the recruitment pages if the public recruitment feature is not needed.

## Timeline

- 2026-10-28T22:35:34+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-118754

## From the sources

Dolibarr ERP CRM before 24.0.2 contains a missing authorization vulnerability in htdocs/public/recruitment/view.php that allows unauthenticated attackers to view unpublished draft job positions. Attackers can enumerate sequential provisional references via the ref parameter to read titles, descriptions, salary budgets, and recruiter names and emails.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_