CodeAstro HRMS CVE-2026-11491

Exploitation requires the attacker to hold a high-privilege account in the CodeAstro HRMS (PR:H per CVSS vector) - this is not exploitable by unauthenticated or low-privileged users. The Notice Board Management feature must be in use and accessible, and the /notice/All_notice endpoint must be reachable. A victim user must subsequently view the notice board page for the stored payload to execute (UI:R per CVSS vector). Exploitation is limited to integrity impact only (I:L); there is no direct confidentiality breach or availability disruption from the base vulnerability alone. The attack does not require unusual server-side configuration beyond the default availability of the notice board feature. Scope is unchanged, meaning the exploit does not break out of the application's privilege boundary.

The aggregate risk signal for this vulnerability is low-to-moderate. The CVSS 3.1 base score of 2.4 is appropriately calibrated: AV:N confirms remote reachability, but PR:H establishes that an attacker must already hold high-privilege access to the HRMS - a significant precondition that eliminates opportunistic, unauthenticated exploitation. UI:R further requires that a victim actively view the poisoned notice, adding a second dependency. The scope is unchanged (S:U) with no confidentiality or availability impact and only low integrity impact, meaning the practical ceiling for this exploit, absent chaining with other vulnerabilities, is limited script execution (session hijacking, credential phishing, defacement within the notice context). A publicly available proof-of-concept exists on GitHub (E:P in CVSS temporal), which increases the ease of exploitation but does not change the fundamental access prerequisite. No EPSS data was provided in the source intelligence; given the niche deployment base of a single vendor's HRMS product and the high-privilege requirement, exploitation probability is expected to be low. This vulnerability is not listed in the CISA KEV catalog, and no EPSS score was supplied, so widespread active exploitation is not confirmed. The primary realistic threat actor is a malicious insider or compromised admin account within the organization.

An attacker with administrative access to the CodeAstro HRMS - whether a malicious insider or an operator using a compromised admin account - submits a crafted notice with the title containing an SVG onload payload via POST to /notice/All_notice; a publicly available proof-of-concept demonstrates the exact request structure. When any other HRMS user navigates to the notice board, the stored payload executes in their browser session, potentially enabling session token theft or credential harvesting via a phishing overlay within the application context.