Is there a public PoC exploit available for CVE-2026-6201?

Yes, a public proof-of-concept exploit is available for CVE-2026-6201. Prioritise patching immediately. EPSS: 0.0%.

Online Job Portal CVE-2026-6201

Q: What is the CVSS score of CVE-2026-6201?

CVE-2026-6201 has a CVSS 4.0 base score of 2.1 (Low). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-22067 LOW

Improper Access Control (CWE-284)

2026-04-13 VulDB

GHSA-rg27-r833-h4m8

Authentication Bypass PHP Online Job Portal

2.1

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

2.1 LOW

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

5.4 MEDIUM

Network-accessible IDOR requiring authenticated low-privilege user (PR:L); impact limited to deleting others' postings (I:L/A:L) with no confidentiality breach (C:N).

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N

Primary rating from NVD.

CVSS VectorNVD

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Jul 24, 2026 - 08:04 vuln.today

Severity Changed

Apr 29, 2026 - 01:12 NVD

MEDIUM LOW

CVSS changed

Apr 29, 2026 - 01:12 NVD

5.3 (MEDIUM) 2.1 (LOW)

PoC Detected

Apr 29, 2026 - 01:00 vuln.today

Public exploit code

CVSS changed

Apr 13, 2026 - 20:22 NVD

5.4 (MEDIUM) 5.3 (MEDIUM)

EUVD ID Assigned

Apr 13, 2026 - 19:30 euvd

EUVD-2026-22067

CVE Published

Apr 13, 2026 - 19:00 nvd

LOW 2.1

DescriptionCVE.org

A vulnerability was identified in CodeAstro Online Job Portal 1.0. The impacted element is an unknown function of the file /jobs/job-delete.php of the component Delete Job Posting Handler. Such manipulation of the argument ID leads to improper access controls. The attack can be launched remotely. The exploit is publicly available and might be used.

AnalysisAI

Improper access control in CodeAstro Online Job Portal 1.0 enables any authenticated user to delete job postings owned by other users by manipulating the ID parameter in requests to /jobs/job-delete.php. A proof-of-concept exploit is publicly available on GitHub. Despite the network-accessible attack vector, real-world risk is constrained by the authentication requirement, the low EPSS score (0.04%, 11th percentile), and the niche deployment footprint of this PHP application - no CISA KEV listing and no active exploitation signals have been observed.

Technical ContextAI

CodeAstro Online Job Portal 1.0 (CPE: cpe:2.3:a:codeastro:online_job_portal:*:*:*:*:*:*:*:*) is a PHP-based web application. The Delete Job Posting Handler at /jobs/job-delete.php processes a user-supplied ID parameter to identify which job posting to remove. The root cause is CWE-284 (Improper Access Control), manifesting as an Insecure Direct Object Reference (IDOR): the backend trusts the client-supplied ID value without verifying that the requesting authenticated session corresponds to the owner of the referenced posting. This is a classic server-side authorization enforcement failure common in PHP applications that lack object-level permission checks.

RemediationAI

No vendor-released patch has been identified at time of analysis. The primary fix requires adding a server-side ownership verification check in /jobs/job-delete.php - before executing any deletion, the application must confirm that the authenticated session's user ID matches the owner of the job posting identified by the ID parameter; failure to match should return a 403 and abort the operation. As an interim compensating control, administrators can restrict access to the deletion endpoint via WAF rules or web server ACLs, limiting it to specific authenticated roles (e.g., admin-only) - this trades functionality for reduced exposure. Disabling the delete feature entirely until a patch is applied is the most conservative option. Monitor VulDB (https://vuldb.com/vuln/357123) and the vendor site (https://codeastro.com/) for patch releases.