Gojobs
Monthly
Insecure Direct Object Reference (IDOR) in GoJobs, a REST API job board platform by karnop, exposes job records to unauthenticated network attackers who enumerate object identifiers on the job retrieval endpoint. The endpoint performs no authentication or authorization checks, meaning any external user can retrieve arbitrary job postings by iterating numeric or sequential IDs. A proof-of-concept exists per SSVC intelligence and exploitation is rated automatable, though EPSS probability remains very low (0.05%, 14th percentile) and no active exploitation has been confirmed in CISA KEV.
Insecure Direct Object Reference (IDOR) in GoJobs, a REST API job board platform by karnop, exposes job records to unauthenticated network attackers who enumerate object identifiers on the job retrieval endpoint. The endpoint performs no authentication or authorization checks, meaning any external user can retrieve arbitrary job postings by iterating numeric or sequential IDs. A proof-of-concept exists per SSVC intelligence and exploitation is rated automatable, though EPSS probability remains very low (0.05%, 14th percentile) and no active exploitation has been confirmed in CISA KEV.