CodeAstro HRMS CVE-2026-13537

Exploitation requires that a human user with an active authenticated session in the CodeAstro HR Management System visit or be redirected to an attacker-controlled page or resource that contains the forged CSRF payload. The attacker themselves requires no authentication or account on the target system. The victim must be logged into the application at the time of the attack - if the session has expired or the user is not authenticated, the forged request will fail. The specific endpoint confirmed vulnerable is the department deletion function. Limiting factors: user interaction is mandatory (UI:P), meaning fully automated exploitation without any victim action is not possible; the attack window is bounded by the victim's session lifetime; and impact is limited to integrity loss on department records (VI:L), not full system compromise or data exfiltration.

The CVSS 4.0 score of 5.3 with vector AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N reflects a medium-severity, integrity-limited vulnerability. The attack is network-reachable and requires no attacker privileges, but it is gated by mandatory user interaction (UI:P) - the victim must be authenticated and visit a malicious page, meaning the attacker cannot achieve exploitation autonomously. Impact is confined to limited integrity loss (VI:L), specifically the ability to trigger unauthorized department deletion; no confidentiality or availability impact is indicated. The absence of a CISA KEV listing means active exploitation is not confirmed, though the public PoC on GitHub meaningfully elevates risk above theoretical. Real-world priority is low-to-medium: the product appears to have a niche deployment footprint, limiting blast radius. The primary concern is insider-adjacent or targeted phishing attacks against HR administrators of organizations using this specific software. No EPSS data was provided, so exploitation probability cannot be quantified independently.

An attacker crafts a web page containing a hidden HTML form that auto-submits a POST request to the target organization's CodeAstro HR system department deletion endpoint. The attacker then social-engineers an authenticated HR administrator into visiting the malicious page - for example, via a phishing email with a link disguised as an HR policy document. Upon page load, the victim's browser automatically sends the forged deletion request with the authenticated session cookie attached, causing the server to delete the targeted department record without any confirmation from the legitimate user. A public PoC demonstrating this exact technique is available on GitHub.