CVE-2026-118754
Publication date 29 October 2026
Last updated 29 October 2026
Ubuntu priority
Description
Dolibarr ERP CRM before 24.0.2 contains a missing authorization vulnerability in htdocs/public/recruitment/view.php that allows unauthenticated attackers to view unpublished draft job positions. Attackers can enumerate sequential provisional references via the ref parameter to read titles, descriptions, salary budgets, and recruiter names and emails.
Status
| Package | Ubuntu Release | Status |
|---|---|---|
| dolibarr | 26.10 stonking | Not in release |
| 26.04 LTS resolute | Not in release | |
| 24.04 LTS noble | Not in release | |
| 22.04 LTS jammy | Not in release | |
| 16.04 LTS xenial |
Needs evaluation
|
Severity score breakdown
CVSS version:
Base score
6.9 · Medium
Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N
Base score
5.3 · Medium
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
References
Other references
- https://www.cve.org/CVERecord?id=CVE-2026-118754
- https://github.com/Dolibarr/dolibarr
- https://github.com/Dolibarr/dolibarr/blob/24.0.1/htdocs/public/recruitment/view.php#L106
- https://github.com/Dolibarr/dolibarr/commit/f4ee5e9722c7ae04bf22a4afff8d8b91802d8157
- https://github.com/Dolibarr/dolibarr/pull/41108
- https://www.vulncheck.com/advisories/dolibarr-erp-crm-before-24.0.2-missing-authorization-via-public-recruitment-view-php