CVE-2026-118754 in Dolibarr
Summary
by MITRE • 10/29/2026
Dolibarr ERP CRM before 24.0.2 contains a missing authorization vulnerability in htdocs/public/recruitment/view.php that allows unauthenticated attackers to view unpublished draft job positions. Attackers can enumerate sequential provisional references via the ref parameter to read titles, descriptions, salary budgets, and recruiter names and emails.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 10/29/2026
The identified vulnerability resides within the Dolibarr ERP CRM software, specifically affecting versions prior to 24.0.2 in the file htdocs/public/recruitment/view.php. This component is responsible for displaying details regarding job positions managed by organizations using the platform. The core technical flaw is a missing authorization check that fails to validate whether the requesting user has appropriate permissions or authentication status before rendering sensitive recruitment data. Consequently, this oversight allows unauthenticated attackers to access information intended only for authorized internal staff members who manage hiring processes.
The operational impact of this vulnerability centers on the exposure of unpublished draft job positions. Because these entries are not yet public postings but rather internal planning documents, their leakage reveals strategic workforce intentions before they are officially announced. Attackers can exploit a predictable sequential reference mechanism via the ref parameter to enumerate and access multiple records systematically. This enumeration capability transforms an isolated information leak into a broader data harvesting operation where attackers can iterate through potential identifiers to collect a comprehensive dataset of organizational hiring plans without triggering authentication barriers or error messages that might alert security monitoring systems.
The specific types of sensitive information exposed include job titles, detailed descriptions of roles, salary budget allocations, and the names along with email addresses of assigned recruiters. The disclosure of recruiter contact details poses significant risks beyond mere data leakage, as it facilitates targeted social engineering attacks such as spear phishing against HR personnel who may be unaware their professional identity has been compromised alongside organizational strategy. Furthermore, knowledge of unpublished job roles allows competitors to anticipate business expansion areas or restructuring efforts, providing an unfair strategic advantage in the marketplace by revealing internal operational priorities and financial commitments related to human resources before they are publicly known.
From a classification perspective, this vulnerability aligns with CWE-284 Improper Access Control, as it involves failing to enforce proper authorization policies for sensitive data access. Additionally, the ability of an unauthenticated actor to enumerate sequential identifiers maps directly to ATT&CK technique T1078 Valid Accounts when considering that valid internal roles are being accessed without credentials, and potentially CWE-200 Information Exposure if viewed through the lens of unintended disclosure of organizational intelligence. The lack of authentication requirement also touches upon principles related to broken access control where public-facing endpoints do not adequately restrict access based on user privilege levels or session state.
Mitigation strategies must prioritize immediate patching by upgrading Dolibarr ERP CRM to version 24.0.2 or later, which addresses the authorization logic in the recruitment module. Until an upgrade is feasible, administrators should implement web application firewall rules that detect and block sequential enumeration patterns targeting the ref parameter for recruitment views. It is also advisable to review access control configurations across all public-facing modules to ensure consistent enforcement of authentication requirements. Organizations relying on this software should audit their internal processes to assess whether any sensitive draft data was exposed during the window of vulnerability, particularly checking for unauthorized access logs that might indicate active exploitation attempts against recruiter contact information and salary structures.