HUMANIST DHRS CVE-2026-14838

Exploitation requires that the attacker obtain the session token from one of the surfaces where GET query strings are exposed: server-side access logs (requires read access to log files or a log aggregation system), HTTP Referer headers forwarded when a user navigates from the HR application to an external domain (the external domain receives the full URL including the token), browser history accessible on the user's endpoint, or a network intermediary (proxy, MITM) positioned between client and server. The application must be running in version 26.0 and the attacker must be able to use the captured token before session expiry. Authentication to the HR application itself is NOT required for the attacker - but they must be in one of the above privileged positions to harvest the token. The CVSS AC:H rating directly encodes these enabling conditions. There is no evidence that exploitation is possible in a fully default-isolated deployment where log access is restricted and no external Referer targets are loaded.

The official CVSS 3.1 score of 7.4 (High) with vector AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N reflects a nuanced picture: while the attack requires no authentication or user interaction, AC:H explicitly signals that exploitation is not straightforward and requires specific enabling conditions such as access to log infrastructure, a network interception position, or control of a page that receives Referer headers from the HR application. No EPSS score was provided in the input, so quantitative exploitation probability cannot be cited. This vulnerability is not listed in the CISA KEV catalog and no public exploit or proof-of-concept has been identified. Given the niche, regional deployment footprint of this Turkish HR product, mass exploitation is unlikely; however, insider threats (e.g., a system administrator with log access) or targeted attacks against organizations using HUMANIST DHRS present realistic risk. The High C and I scores are appropriate - a stolen session token grants full impersonation of the victim user. EPSS data is missing and must be confirmed separately.

An attacker with read access to the application's web server or proxy access logs (e.g., a system administrator or a compromised log aggregation service) extracts a valid session token from a logged URL query string belonging to an authenticated HR employee or administrator. The attacker replays that token via a crafted request, gaining full access to the victim's HUMANIST DHRS session, including HR records, payroll data, and employee PII. No public proof-of-concept has been identified, but the technique requires no specialized tooling.