CVE-2026-38568 - Vulnerability Analysis

Overview

HireFlow v1.2 contains an incorrect access control vulnerability caused by lack of object-level authorization on /candidate/<id> and /interview/<id> endpoints, letting authenticated users access other users' data, exploit requires authentication.

Severity & Score

Impact

Authenticated users can access all other users' candidate profiles and interview notes, leading to full data breach and horizontal privilege escalation.

Mitigation

Update to the latest version with proper object-level authorization checks.

References

• https://www.sourcecodester.com/python/18688/hireflow-%E2%80%93-complete-interview-management-system.html
• https://github.com/StratonWebDesigners/HireFlow
• https://github.com/hijackedamygdala/CVE-Disclosures/tree/main/HireFlow/CVE-2026-38568

Related Resources

• Vulnerability Intelligence Dashboard
• Credential Scanner