Is there a public PoC exploit available for CVE-2026-15188?

Yes, a public proof-of-concept exploit is available for CVE-2026-15188. Prioritise patching immediately. EPSS: 0.2%.

django-job-portal CVE-2026-15188

Q: What is the CVSS score of CVE-2026-15188?

CVE-2026-15188 has a CVSS 4.0 base score of 2.1 (Low). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.2%.

EUVD-2026-42606 LOW

Improper Access Control (CWE-284)

2026-07-09 VulDB

GHSA-2rhq-gr66-449j

Authentication Bypass Python Django Job Portal Manjurulhoque

2.1

CVSS 4.0 · Vendor: VulDB

Severity by source

Vendor (VulDB) PRIMARY

2.1 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

5.4 MEDIUM

Employee-level authentication required (PR:L); role manipulation yields low confidentiality and integrity impact with no identified availability consequence.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (VulDB).

CVSS VectorVendor: VulDB

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Jul 09, 2026 - 17:09 vuln.today

Severity Changed

Jul 09, 2026 - 16:22 NVD

MEDIUM LOW

CVSS changed

Jul 09, 2026 - 16:22 NVD

5.3 (MEDIUM) 2.1 (LOW)

DescriptionCVE.org

A weakness has been identified in manjurulhoque django-job-portal up to dfa352f305bba44445ac5dc12e9b2a98c9dcd71f. Affected by this vulnerability is the function EditEmployeeProfileAPIView of the file accounts/api/views.py of the component Employee Dashboard Endpoint. This manipulation of the argument role causes improper access controls. The attack may be initiated remotely. The exploit has been made available to the public and could be used for attacks. This product uses a rolling release model to deliver continuous updates. As a result, specific version information for affected or updated releases is not available. The project was informed of the problem early through an issue report but has not responded yet.

AnalysisAI

Improper access control in manjurulhoque's django-job-portal allows authenticated remote attackers to manipulate the role argument via the EditEmployeeProfileAPIView endpoint, enabling unauthorized privilege escalation within the Employee Dashboard. All commits up to dfa352f305bba44445ac5dc12e9b2a98c9dcd71f are affected under a rolling release model with no fixed version available. A publicly available proof-of-concept exploit exists via GitHub issue #91; the project maintainer has not responded to disclosure and no patch has been released.

Technical ContextAI

The affected code resides in accounts/api/views.py within the EditEmployeeProfileAPIView class, a Django REST Framework API view responsible for handling employee profile updates. CWE-284 (Improper Access Control) identifies the root cause as a failure to enforce field-level authorization - specifically, the role field is accepted from user-supplied input without validating whether the requesting user has the privilege to modify it. This is a classic Django mass-assignment or parameter-tampering pattern where Django REST Framework serializers expose writable fields (including sensitive ones like role) that should be restricted via read_only_fields or permission-scoped serializer logic. The CPE string cpe:2.3:a:manjurulhoque:django-job-portal:*:*:*:*:*:*:*:* indicates no version pinning is possible, as the project uses rolling commits rather than tagged releases.

RemediationAI

No vendor-released patch has been identified at time of analysis - the maintainer has not responded to the responsible disclosure filed via GitHub issue #91. Organizations running this software should apply the following compensating controls immediately: in the DRF serializer for employee profile updates, explicitly add role to read_only_fields to prevent it from being written via API input; add a server-side permission check in EditEmployeeProfileAPIView that rejects any request containing a role field unless the requesting user holds admin-level privileges; and restrict access to the Employee Dashboard API routes via network-level controls or application-layer middleware where possible. Monitor https://github.com/manjurulhoque/django-job-portal/issues/91 for any upstream fix. Note that adding role to read_only_fields is non-breaking but will silently ignore the field rather than returning an error - explicit validation with a 403 response is preferable for auditability.