What is the CVSS score of CVE-2026-38566?

CVE-2026-38566 has a CVSS 3.1 base score of 8.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N. EPSS exploitation probability: 0.0%.

Which versions of HireFlow are affected by CVE-2026-38566?

HireFlow v1.2 contains a critical CSRF vulnerability allowing attackers to manipulate authenticated user sessions to change passwords, delete candidate records, and alter interview schedules through…

How to fix or mitigate CVE-2026-38566?

Within 24 hours: Identify all HireFlow v1.2 instances in production and document current deployment. Within 7 days: Implement emergency mitigation by enforcing SameSite=Strict on all session cookies via HireFlow configuration or reverse proxy rewrite rules; conduct user awareness training on phishing risks targeting HireFlow access. Within 30 days: Monitor vendor advisories for patch release; evaluate upgrade path to patched version or replace with alternative vendor if patch timeline is indefinite.

HireFlow CVE-2026-38566

EUVD-2026-29114 HIGH

Cross-Site Request Forgery (CSRF) (CWE-352)

2026-05-11 mitre

GHSA-2qgc-8m4g-h724

CSRF N A

8.1

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.1 HIGH

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

None

Lifecycle Timeline

Analysis Generated

May 12, 2026 - 16:31 vuln.today

CVSS changed

May 12, 2026 - 14:22 NVD

8.1 (HIGH)

CVE Published

May 11, 2026 - 00:00 nvd

UNKNOWN (no severity yet)

CVE Published

May 11, 2026 - 00:00 nvd

HIGH 8.1

DescriptionCVE.org

HireFlow v1.2 does not implement CSRF token validation on any state-changing POST endpoint. All forms (password change at /profile, candidate deletion at /candidates/delete/<id>, feedback submission at /feedback/add/<id>, interview scheduling at /interviews/add) are vulnerable to CSRF. An attacker who can trick an authenticated user into visiting a malicious page can silently change the victim's password, delete records, or inject arbitrary data on their behalf. The SESSION_COOKIE_SAMESITE attribute is also not configured, removing the browser-level CSRF defense.

AnalysisAI

Cross-Site Request Forgery (CSRF) in HireFlow v1.2 allows remote attackers to perform unauthorized actions on behalf of authenticated users without token validation on any state-changing endpoint. An attacker can craft malicious web pages to silently change victim passwords, delete candidate records, inject feedback, or schedule interviews when visited by an authenticated user. The absence of SESSION_COOKIE_SAMESITE configuration removes browser-level CSRF defenses. Publicly available exploit code exists (SSVC exploitation status: POC), though EPSS score of 0.02% (4th percentile) suggests limited widespread targeting. CVSS 8.1 reflects high confidentiality and integrity impact requiring only user interaction (UI:R), making this a realistic threat in phishing scenarios despite no active exploitation confirmed at time of analysis.

Technical ContextAI

CSRF (CWE-352) is a web security vulnerability that forces authenticated users to execute unwanted actions on a web application. HireFlow v1.2, a Python-based interview management system available on SourceCodester and GitHub (StratonWebDesigners/HireFlow), fails to implement anti-CSRF tokens on POST endpoints handling password changes (/profile), candidate deletion (/candidates/delete/<id>), feedback submission (/feedback/add/<id>), and interview scheduling (/interviews/add). The application additionally fails to configure SESSION_COOKIE_SAMESITE attribute, which would normally instruct browsers to prevent cookies from being sent with cross-site requests. This dual failure removes both application-level and browser-level CSRF protections, allowing attackers to exploit standard HTML form submission or JavaScript fetch() calls from malicious third-party sites while the victim's authentication session remains active.

RemediationAI

Upgrade to a patched version of HireFlow if available by checking the official GitHub repository (https://github.com/StratonWebDesigners/HireFlow) for security updates addressing CVE-2026-38566. No vendor-released patch version is confirmed in available data at time of analysis. If no patch exists, implement the following compensating controls: (1) Add CSRF token generation and validation to all state-changing POST endpoints using a framework-native mechanism (e.g., Flask-WTF for Flask applications or Django CSRF middleware) - requires code modification and testing of all forms. (2) Configure SESSION_COOKIE_SAMESITE='Lax' or 'Strict' in application configuration to enable browser-level protection (Strict prevents all cross-site cookie transmission but may break legitimate cross-site workflows; Lax allows top-level navigation). (3) Implement additional authentication challenges (re-authentication or CAPTCHA) for high-risk operations like password changes and candidate deletion - adds user friction. (4) Deploy Web Application Firewall (WAF) rules to detect and block requests with suspicious Referer/Origin headers not matching the application domain - may cause false positives with legitimate proxy configurations. (5) Educate users to log out after HireFlow sessions and avoid clicking unknown links while authenticated - relies on user behavior. Refer to researcher disclosure at https://github.com/hijackedamygdala/CVE-Disclosures/tree/main/HireFlow/CVE-2026-38566 for technical details on affected endpoints.