GoJobs
CVE-2026-44341
MEDIUM
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Network-reachable unauthenticated read-only endpoint; no integrity or availability impact; confidentiality limited to partial job data disclosure.
Primary rating from GitHub Advisory.
CVSS VectorGitHub Advisory
Lifecycle Timeline
2DescriptionGitHub Advisory
GoJobs is a REST API for a Job Board platform. The application exposes a job retrieval endpoint that allows unauthenticated users to access job details by directly manipulating object identifiers. The endpoint lacks proper authentication and authorization checks, resulting in unauthorized access to job data.
AnalysisAI
Insecure Direct Object Reference (IDOR) in GoJobs, a REST API job board platform by karnop, exposes job records to unauthenticated network attackers who enumerate object identifiers on the job retrieval endpoint. The endpoint performs no authentication or authorization checks, meaning any external user can retrieve arbitrary job postings by iterating numeric or sequential IDs. A proof-of-concept exists per SSVC intelligence and exploitation is rated automatable, though EPSS probability remains very low (0.05%, 14th percentile) and no active exploitation has been confirmed in CISA KEV.
Technical ContextAI
GoJobs is an open-source REST API project (cpe:2.3:a:karnop:gojobs:*:*:*:*:*:*:*:*) designed for job board platforms. The root cause is CWE-284 (Improper Access Control), a class of flaws where application logic fails to enforce who can read, modify, or act on resources. In this case, the job retrieval endpoint accepts a user-controlled object identifier (job ID) in the request path or query string and returns the corresponding job record without verifying whether the requester is authenticated or authorized to view it. This is a classic IDOR (Insecure Direct Object Reference) pattern, typically arising when developers expose internal database keys directly in API URLs without coupling them to session or token validation. Because GoJobs is a REST API, the attack surface is purely HTTP-based and trivially scriptable.
RemediationAI
No vendor-released patched version has been independently confirmed from the available data. Operators should consult the GitHub Security Advisory at https://github.com/karnop/gojobs/security/advisories/GHSA-x2j8-h9xc-wpgf for any upstream fix commits or guidance. As an immediate compensating control, restrict access to the job retrieval endpoint behind authentication middleware so that only authenticated sessions or valid API tokens can invoke it. If the job data is genuinely intended to be public, implement rate-limiting and ID obfuscation (e.g., UUIDs instead of sequential integers) to prevent automated enumeration. Deployers running GoJobs behind a reverse proxy should consider adding an IP allowlist or require token authentication at the proxy layer until a code-level fix is available. Note that rate-limiting alone does not address the authorization flaw - it only slows enumeration.
Same weakness CWE-284 – Improper Access Control
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today