Dolibarr ERP CRM CVE-2026-118754

The optional public recruitment interface must be enabled via the RECRUITMENT_ENABLE_PUBLIC_INTERFACE global setting - the patch diff shows the page is served only when this flag is set, so instances without it are not exposed. Where it is enabled, any unauthenticated remote user can reach htdocs/public/recruitment/view.php and enumerate the sequential provisional 'ref' parameter because the pre-patch code never checked the job position's draft/published status (the fix adds a STATUS_DRAFT and $object->id <= 0 guard returning 404). Limiting factors: exposure is confined to deployments that have turned on the public recruitment feature, and impact is limited to confidentiality of draft job data (titles, descriptions, salary budgets, recruiter names and emails) - no integrity or availability impact and no authentication to bypass.

Signals are consistent and point to a moderate, confidentiality-only information-disclosure issue rather than a top-tier emergency. The supplied CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) scores 6.9 and correctly reflects unauthenticated, low-complexity network access with only low confidentiality impact (VC:L) and no integrity or availability effect (VI:N/VA:N). No EPSS score was provided, so exploitation probability cannot be quantified. The vulnerability is NOT on the CISA KEV list (no active exploitation confirmed), and the input does not mark any PoC as confirmed working exploit code - a VulnCheck advisory reference exists but is not verified as a working exploit, so this is treated as no public exploit identified at time of analysis. The vuln.today decision label is 'this_month' (not act_now/emergency), aligning with the picture of a real but non-urgent data-exposure flaw. The one caveat not captured by the raw score: exploitation depends on the optional public recruitment interface being enabled (see exploitation_conditions), which is a deployment-specific precondition the CVSS vector does not express - so real-world exposure is narrower than AV:N/PR:N alone suggests.

An attacker locates a Dolibarr instance that has the public recruitment interface enabled and requests htdocs/public/recruitment/view.php while incrementing the sequential 'ref' parameter. Because the pre-patch code did not verify that a job position was published (non-draft), the unauthenticated attacker reads unpublished draft postings and harvests titles, descriptions, salary budgets, and recruiter names and emails. No authentication or user interaction is required, but no public exploit was identified at time of analysis.