HUMANIST Digital Human Resources CVE-2026-14465

Exploitation requires that the attacker first obtain a valid session token from a currently or previously authenticated HUMANIST user - this is the prerequisite encoded in UI:R. The session token must be acquired through a secondary vector such as network interception (HTTP or improperly configured HTTPS), XSS within the application, server-side log access, or browser storage theft. The vulnerability itself then requires no further interaction: the attacker replays the captured token against the network-accessible application with no privileges of their own (PR:N). Exploitation is limited to HUMANIST Digital Human Resources version 26.0 and does not affect version 26.1 or later. There is no indication that default configurations differ in exploitability - the flaw is present in the session management layer regardless of feature configuration.

The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N) scores 6.5 (Medium), reflecting network accessibility and low attack complexity offset by required user interaction and no integrity or availability impact. The UI:R flag is the key limiting signal - exploitation presupposes that the attacker has already obtained a valid session token, implying a prerequisite step such as network interception, XSS, or access to application logs. No EPSS data was provided in the source intelligence, and this CVE is absent from the CISA KEV catalog, suggesting no observed active exploitation. Given the niche deployment footprint of this product (a Turkish-market HR SaaS), real-world blast radius is narrow. The high confidentiality impact is credible given HR platforms routinely hold personally identifiable employee data, payroll records, and organizational charts. Overall, this is a real risk for organizations running this specific platform but not a broad-ecosystem priority.

An attacker intercepts a valid HUMANIST session token via a man-in-the-middle attack on an unencrypted connection, captures it from application logs, or extracts it through a stored XSS payload in an HR record field. Because the application does not expire or invalidate the token after the legitimate user logs out, the attacker replays the stolen token in subsequent requests to browse sensitive HR data such as employee records, payroll information, or organizational charts. No public proof-of-concept has been identified; however, the attack technique is generic and well-understood.