CVE and update status of the FreeBSD ports tree3,532 unaddressed CVEs in 701 portsAll times are CET
CVE details

CVE-2026-118754

Dolibarr ERP CRM before 24.0.2 contains a missing authorization vulnerability in htdocs/public/recruitment/view.php that allows unauthenticated attackers to view unpublished draft job positions. Attackers can enumerate sequential provisional references via the ref parameter to read titles, descriptions, salary budgets, and recruiter names and emails.

Score
6.9 medium
Published
2026-10-28
Links
NVD · cve.org · Report wrong data

Matched ports (5)

PortPackageVersionStatusMaintainer
www/dolibarrdolibarr23.0.4unaddressedacm@FreeBSD.org
www/dolibarr19dolibarr1919.0.4_1unaddressedacm@FreeBSD.org
www/dolibarr20dolibarr2020.0.4_1unaddressedacm@FreeBSD.org
www/dolibarr21dolibarr2121.0.4unaddressedacm@FreeBSD.org
www/dolibarr22dolibarr2222.0.5unaddressedacm@FreeBSD.org

Template for a VuXML entry

This generator is not reliable at the moment

Package names, ranges and the XML itself can be wrong. Always check the content before you commit it, and run make validate in security/vuxml. The generator is being rewritten from scratch.

Range per package from the fixed version in the CVE rows that match this port, converted to pkg notation and checked with pkg; for ports with a version line in their name (python312) only from that line. make newentry in security/vuxml creates the vid.

  <vuln vid="FIXME (make newentry)">
    <topic>FIXME -- FIXME</topic>
    <affects>
      <package>
	<name>dolibarr</name>
	<!-- fixed only in the 24.x line, check for a backport to 23.x -->
	<range><lt>24.0.2</lt></range>
      </package>
      <package>
	<name>dolibarr19</name>
	<!-- no fixed release for the 19 line in the CVE record (fixed in 24.0.2) -->
	<range><lt>FIXME</lt></range>
      </package>
      <package>
	<name>dolibarr20</name>
	<!-- no fixed release for the 20 line in the CVE record (fixed in 24.0.2) -->
	<range><lt>FIXME</lt></range>
      </package>
      <package>
	<name>dolibarr21</name>
	<!-- no fixed release for the 21 line in the CVE record (fixed in 24.0.2) -->
	<range><lt>FIXME</lt></range>
      </package>
      <package>
	<name>dolibarr22</name>
	<!-- no fixed release for the 22 line in the CVE record (fixed in 24.0.2) -->
	<range><lt>FIXME</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>Dolibarr ERP CRM before 24.0.2 contains a missing authorization
	  vulnerability in htdocs/public/recruitment/view.php that allows
	  unauthenticated attackers to view unpublished draft job positions.
	  Attackers can enumerate sequential provisional references via the ref
	  parameter to read titles, descriptions, salary budgets, and recruiter
	  names and emails.</p>
      </body>
    </description>
    <references>
      <cvename>CVE-2026-118754</cvename>
      <url>https://nvd.nist.gov/vuln/detail/CVE-2026-118754</url>
    </references>
    <dates>
      <discovery>2026-10-28</discovery>
      <entry>2026-10-29</entry>
    </dates>
  </vuln>