Online Job Portal CVE-2026-6201

The attacker must hold a valid authenticated session on the target instance - the CVSS 4.0 vector specifies PR:L, confirming low-privilege authentication is required. Exploitation proceeds over the network (AV:N) with no user interaction from a victim. No special non-default configuration is required beyond having user accounts enabled, which is the default operating mode of the portal. Exploitation is limited by: the requirement for a pre-existing authenticated account (ruling out anonymous/unauthenticated abuse), the application's niche deployment footprint, and the impact scope restricted to deletion of job postings with no code execution or data exfiltration possible. The SSVC 'Automatable: no' designation suggests reliable exploitation requires manual identification of valid target IDs.

The CVSS 4.0 score of 2.1 (Low) reflects the authentication requirement (PR:L) and partial, limited impact (VI:L/VA:L - integrity and availability only, no confidentiality breach). EPSS at 0.04% (11th percentile) independently corroborates a very low real-world exploitation probability. SSVC signals non-automatable exploitation and only partial technical impact, consistent with CVSS. A POC is publicly available on GitHub, which elevates theoretical accessibility, but SSVC's 'Automatable: no' and the required authenticated session significantly limit mass exploitation potential. No CISA KEV listing confirms no observed widespread active exploitation. This is a low-priority finding for most security teams unless the deployment permits untrusted users to register accounts, in which case insider-threat or account-abuse scenarios become more relevant.

An attacker registers or otherwise obtains a valid user account on a CodeAstro Online Job Portal 1.0 instance, authenticates, and sends a crafted HTTP request to /jobs/job-delete.php?id=<target_id> substituting another user's job posting ID. Because no ownership check is enforced server-side, the posting is permanently deleted. A public POC on GitHub (github.com/Xmyronn/CodeAstro-Online-Job-Portal-IDOR.git) demonstrates this exact technique.