CVE-2026-118754mediumCWE-862

CVE-2026-118754: medium-severity vulnerability in Dolibarr ERP/CRM

Dolibarr ERP CRM before 24.0.2 Missing Authorization via public recruitment view.php

Published · Updated

Follow this CVE+ Monitor ERP CRM

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

13Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 6.9epss 0.2%
Dolibarr ERP CRM before 24.0.2 contains a missing authorization vulnerability in htdocs/public/recruitment/view.php that allows unauthenticated attackers to view unpublished draft job positions. Attackers can enumerate sequential provisional references via the ref parameter to read titles, descriptions, salary budgets, and recruiter names and emails.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N
Affected products
Dolibarr · Dolibarr ERP/CRM
Related CVEs — Dolibarr ERP/CRM

In the same product, most dangerous first.

CVE-2026-22666HIGHDolibarr ERP/CRM < 23.0.2 Authenticated RCE via dol_eval_standard()EPSS 15.8%CVE-2019-25452HIGHDolibarr ERP/CRM 10.0.1 SQL Injection via elemidEPSS 0.4%CVE-2019-25450HIGHDolibarr ERP/CRM 10.0.1 SQL Injection via card.phpEPSS 0.4%