HUMANIST Digital Human Resources CVE-2026-14192

Exploitation requires the attacker to hold a valid low-privilege authenticated account on the HUMANIST Digital Human Resources platform (confirmed by PR:L in the CVSS vector) - unauthenticated external attackers cannot exploit this vulnerability directly. A victim user (typically a higher-privileged HR administrator) must actively navigate to and render the page containing the stored payload (UI:R per CVSS vector). The vulnerability is specific to version 26.0 of the product; version 26.1 is patched. No non-default configuration or special deployment mode is indicated as required. Limiting factors are: (1) attacker must possess a valid application account; (2) victim must view the poisoned page; (3) the vulnerable product has a limited, industry-specific deployment footprint.

The CVSS 3.1 vector AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N scores 5.4 (Medium), accurately reflecting that network reachability and low attack complexity are offset by the PR:L (authenticated attacker) and UI:R (victim must navigate to the poisoned page) requirements. No EPSS data was included in the intelligence, and the vulnerability is absent from CISA KEV, indicating no confirmed or widespread active exploitation. No POC is publicly identified. For organizations running this HR platform, the practical internal risk centers on session hijacking or credential phishing targeting HR administrators who review user-submitted content - a meaningful insider-threat or compromised-account escalation vector. The limited global footprint of the product constrains broad impact. There are no conflicting signals in the data; CVSS vector and description are consistent.

An attacker with a valid low-privilege account (e.g., a standard employee account) submits a crafted input containing a JavaScript payload into an HR form field - such as an employee profile, leave request comment, or feedback form - that is later rendered in the administrator dashboard without sanitization. When an HR administrator views the affected record, the stored script executes in their browser, allowing the attacker to exfiltrate the administrator's session token and escalate access within the platform. No public POC is known, but the attack pattern is well-understood for Stored XSS in web-based HR applications.