EUVD-2026-29116
GHSA-6fpq-hhv8-hc9f
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
Lifecycle Timeline
4DescriptionCVE.org
HireFlow v1.2 is vulnerable to Incorrect Access Control. The application does not enforce object-level authorization on the /candidate/<id> and /interview/<id> endpoints. The route handlers retrieve records by the user-supplied ID without verifying that the requesting user is the owner or has an authorized role. Any authenticated user can access any other user's candidate profiles and interview notes by iterating the integer ID in the URL path, constituting a horizontal privilege escalation and full data breach of all records in the system.
AnalysisAI
Broken object-level authorization in HireFlow v1.2 exposes all candidate profiles and interview notes to any authenticated user via direct object reference. Attackers with valid low-privilege credentials can enumerate integer IDs in /candidate/<id> and /interview/<id> endpoints to access the entire database, enabling full horizontal privilege escalation and complete data breach. No vendor patch identified at time of analysis. EPSS data not available; no evidence of active exploitation (not in CISA KEV).
Technical ContextAI
HireFlow is a Python-based interview management system distributed via SourceCodester. The vulnerability stems from CWE-639 (Authorization Bypass Through User-Controlled Key), where route handlers directly use user-supplied ID parameters to retrieve database records without implementing object-level authorization checks. The application architecture separates authentication (user must be logged in) from authorization (user can access only their own data), but only enforces the former. The CVSS vector (PR:L) confirms that authentication is required, but once authenticated, no role-based access control or ownership verification occurs. The sequential integer ID scheme makes enumeration trivial, converting a design flaw into a weaponizable data breach vector affecting all records system-wide.
RemediationAI
No vendor-released patch identified at time of analysis. Organizations must implement immediate compensating controls: (1) Add server-side authorization checks in route handlers for /candidate/<id> and /interview/<id> to verify requesting user owns the record or has admin role before database retrieval-consult researcher's disclosure at https://github.com/hijackedamygdala/CVE-Disclosures/tree/main/HireFlow/CVE-2026-38568 for technical details; (2) Replace sequential integer IDs with UUIDs to eliminate enumeration, though this does not fix the root authorization flaw; (3) Enable comprehensive access logging on these endpoints and alert on rapid ID iteration patterns (e.g., >10 distinct IDs per user per minute); (4) Restrict application access to trusted networks via firewall rules or VPN, reducing attack surface to internal threats only-trade-off is loss of remote interviewer access. For production HR systems, consider migrating to mature alternatives with established security track records until HireFlow maintainers release an authoritative patch. Monitor GitHub repository for updates.
LibreNMS before 24.10.0 allows a remote attacker to execute arbitrary code via OS command injection involving AboutContr
Reachable assertion in Open5GS up to version 2.7.6 allows remote unauthenticated attackers to crash the Diameter CER han
A Command Injection issue in the payload build page in BYOB (Build Your Own Botnet) 2.0 allows attackers to execute arbi
Denial of service in Open5GS 2.7.6 and earlier allows network-adjacent attackers with low-privilege Diameter Gx peer acc
Denial of service in Open5GS HSS (Home Subscriber Server) versions 2.7.0 through 2.7.6 is triggered remotely by manipula
Remote command injection in Control Web Panel allows unauthenticated attackers to execute arbitrary OS commands as root
LINQPad before 5.52.01 Pro edition is vulnerable to Unsafe Deserialization in LINQPad.AutoRefManager::PopulateFromCache(
Remote code execution in dash-uploader (Python package for Plotly Dash) versions 0.1.0 through 0.7.0a2 allows unauthenti
Command injection in LiteLLM 1.18.10 lets attackers who can configure MCP (Model Context Protocol) servers supply arbitr
SQL injection in AzuraCast's backup restore flow (versions up to and including 0.23.7) lets an attacker achieve privileg
Arbitrary file read in Yu AI Code Mother v4.3 lets anonymous, remote attackers retrieve files outside the intended previ
Remote code execution in APScheduler (all versions through 3.10.x and 4.0.0a5) is achievable when applications deseriali
Same technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today