HireFlow EUVD-2026-29116

Attacker must possess valid low-privilege credentials (PR:L) to any HireFlow v1.2 instance-any authenticated user account suffices, including guest/interviewer roles with no administrative rights. No special configuration required; default installation with standard authentication is vulnerable. Exploitation works against all deployment modes (on-premise, cloud-hosted) as the flaw is in application logic, not infrastructure. Limiting factors: requires initial credential compromise via phishing, insider access, or credential reuse; application must be network-accessible to attacker (AV:N). The integer ID enumeration attack is visible in access logs if monitoring is enabled, but many HireFlow deployments likely lack robust logging given the application's positioning as a lightweight interview tool.

CVSS 8.1 (High) accurately reflects network accessibility, low attack complexity, and high confidentiality/integrity impact, though the PR:L requirement slightly reduces immediate risk compared to unauthenticated vectors. Real-world risk is HIGH for organizations using HireFlow in production: any disgruntled employee, contractor, or compromised low-privilege account can exfiltrate all candidate PII and interview assessments within minutes via simple ID iteration. The attack is fully automatable (script a loop from ID=1 to ID=N), requires no specialized tools, and leaves minimal audit trail if logging is insufficient. EPSS score unavailable due to recent CVE assignment, but the combination of trivial exploitation, high business impact (recruitment data breaches trigger GDPR/privacy violations), and public proof-of-concept code in the researcher's GitHub repository elevates this above typical IDOR vulnerabilities. NOT in CISA KEV, indicating no confirmed widespread exploitation, but the low barrier to entry and niche application footprint suggest targeted attacks against HR departments are plausible. Key limiting factor: attacker must first obtain valid credentials, shifting this from anonymous internet threat to insider/supply-chain risk scenario.

An authenticated recruiter with a valid HireFlow account discovers the /candidate/42 URL structure while viewing their assigned candidates. They modify the ID to /candidate/1, /candidate/2, etc., in a browser or automated script, harvesting all candidate resumes, contact details, salary expectations, and interview assessments across the organization. Within an hour, they exfiltrate the complete recruitment database. Proof-of-concept code is publicly available in the researcher's GitHub repository, lowering technical barriers to exploitation.