CodeAstro Online Job Portal EUVD-2026-25747

No authentication required; vulnerability is exploitable against default configurations. The attack requires only network connectivity to the CodeAstro application and the /users/user-cvs/ endpoint to be web-accessible. No special conditions, user interaction, or non-default configuration is necessary. The vulnerability exists because the endpoint fails to implement authentication checks (PR:N per CVSS vector) and directory indexing is enabled, allowing direct enumeration. Exploitation is limited only by network access to the application - if the portal is internal or firewalled, external remote exploitation is not possible; if publicly accessible, exploitation is trivial.

CVSS 5.5 with AV:N/AC:L/PR:N/UI:N indicates low attack complexity, no privilege requirements, and remote network accessibility - standard metrics for an unauthenticated information disclosure. The confidentiality impact is rated low (VC:L) in the vector, which understates real-world risk because exposed resume data contains personally identifiable information (PII), employment history, contact details, and potentially sensitive skills or clearances. EPSS score (inferred as 'P' for exploitable) combined with confirmed publicly available exploit code on GitHub elevates risk beyond the CVSS score alone. No KEV status provided, but public exploit code existence with detailed GitHub repository indicates active demonstrable exploitation capability. The vulnerability is NOT a zero-day; exploitation conditions are trivial (unauthenticated HTTP request to a predictable endpoint), making it a genuine priority for any CodeAstro deployment exposed to the internet. Real-world impact depends entirely on deployment context: internal HR systems pose high risk, public-facing portals pose critical risk due to mass PII exposure.

An attacker discovers the CodeAstro Online Job Portal endpoint /users/user-cvs/ via port scanning or web enumeration, then sends an unauthenticated HTTP GET request to the endpoint. The server returns a directory listing or file access without authentication, exposing resume file names and paths. The attacker downloads all available CV files in bulk, extracting PII including applicant names, contact information, employment history, and sometimes home addresses or salary expectations. The GitHub exploit repository provides automated tooling to enumerate and retrieve all resumes at scale.