HUMANIST HR CVE-2026-14202

No special conditions are required beyond network access to the HUMANIST HR application. The CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms that exploitation is feasible from the network without authentication, elevated privileges, or user interaction, meaning it applies to any default-deployed instance of version 26.0 that is network-reachable. The limiting factor is that the attacker must be able to reach the application's authentication or account-lookup endpoint over HTTP/HTTPS; instances deployed only on internal networks without internet exposure face significantly reduced risk. There is no mention of a specific configuration toggle that enables or disables the discrepancy; it appears to be a default behavior of the affected version.

The NVD CVSS 3.1 score of 5.3 (Medium) reflects a limited-impact flaw: confidentiality is partially affected (C:L) but integrity and availability are unaffected (I:N/A:N), and no scope change occurs (S:U). The attack vector is fully network-accessible with no complexity, no privileges, and no user interaction required, making automated exploitation trivial in principle. EPSS data was not provided in the intelligence feed; however, account enumeration vulnerabilities of this class historically see limited automated exploitation at scale unless combined with credential stuffing campaigns. No KEV listing and no public exploit code were identified at time of analysis, which lowers immediate urgency. The primary real-world risk is that HUMANIST HR, as an HR management system, likely stores sensitive employee PII and payroll data, meaning a successful account enumeration could be the first step in a targeted social engineering or credential-stuffing campaign against high-value internal accounts. The risk is best categorized as moderate for organizations actively using this product, and lower for those already on version 26.1.

An unauthenticated attacker sends a series of automated HTTP requests to the HUMANIST HR login or password-reset endpoint with varying usernames or email addresses, observing differences in server response content, HTTP status codes, or response timing. By correlating these discrepancies, the attacker builds a list of valid employee accounts and then uses that list as the target set for a credential-stuffing or spear-phishing campaign against HR or payroll staff. No exploit code is publicly known at time of analysis, but this class of attack requires only standard HTTP tooling.