Dolibarr ERP CRM before 24.0.2 Missing Authorization via public recruitment view.php

Özet

Türkçe özeti henüz hazır değil; şimdilik kaynağın kendi açıklamasını gösteriyoruz.

Dolibarr ERP CRM before 24.0.2 contains a missing authorization vulnerability in htdocs/public/recruitment/view.php that allows unauthenticated attackers to view unpublished draft job positions. Attackers can enumerate sequential provisional references via the ref parameter to read titles, descriptions, salary budgets, and recruiter names and emails.

Etkilenen sürümler1 yazılım

Kaynaklar7 kaynak

• CVE.org kaydı
• NVD kaydı
• github.com/Dolibarr/dolibarr/pull/41108 Yama
• github.com/…ommit/f4ee5e9722c7ae04bf22a4afff8d8b91802d8157 Yama
• vulncheck.com/…-authorization-via-public-recruitment-view-php Üçüncü taraf
• github.com/Dolibarr/dolibarr Diğer
• github.com/…blob/24.0.1/htdocs/public/recruitment/view.php Diğer

Kayıt geçmişi

1. 29 Eki 2026 00:11Yayımlandı

İlgili açıklar

• 5,4 CVE-2026-75520Domoticz: Missing authorization and path traversal in the udevices Lua parser handler
• 7,3 CVE-2026-61571AVideo-Encoder: missing authentication on control and status endpoints
• 7,5 CVE-2026-118804Bricks Broken Access Control via query_result Endpoint
• 6,5 CVE-2026-118757PiWeb Disable payment method / Partial payment for WooCommerce before 1.1.10.9 Missing Authorization via update_fees
• 6,5 CVE-2026-105620PostgreSQL Anonymizer: A masked role reads the authentic data of masked tables through a masking rule with a sub-query
• 5,7 CVE-2026-105618PostgreSQL Anonymizer: Masked partitions and child tables are not masked when they are queried through their parent