Missing Authorization in Dolibarr ERP CRM Allows Access to Unpublished Job Positions

CVE-2026-118754

What is CVE-2026-118754?

Dolibarr ERP CRM versions prior to 24.0.2 have a vulnerability in the recruitment module that allows unauthenticated attackers to access unpublished draft job positions. By manipulating the ref parameter, attackers can sequentially read valuable information, including job titles, descriptions, salary budgets, and the names and emails of recruiters. This oversight poses significant privacy and data exposure risks, especially for organizations that rely on secure recruitment processes.

References