The exploit targets a missing authorization check in the public recruitment view script, enabling an unauthenticated attacker to retrieve unpublished job positions. By accessing sequential references through the ref parameter, the attacker can read titles, descriptions, salary information, and recruiter contact details, which aligns with CWE‑862. This lack of access control leads directly to sensitive data exposure.

Dolibarr ERP/CRM installations using any version prior to 24.0.2 are affected. The vulnerability resides in the Dolibarr ERP/CRM main application, specifically the htdocs/public/recruitment/view.php file. Users running earlier releases without the upstream patch are at risk.

The CVSS score of 6.9 classifies the flaw as moderate severity, while the EPSS value is not available, and it is not listed in the CISA KEV catalog. The flaw does not require any special privileges and can be exploited over the public web by sending a crafted request to the view.php endpoint, making it readily exploitable for unauthenticated attackers.