CVE-2026-24036mediumCWE-284

CVE-2026-24036: falha de média gravidade em horilla-opensource horilla

Horilla Exposes Unpublished Job Disclosures through Unauthenticated API

Publicada em

Seguir esta CVE+ Monitorar horilla

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

13Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 5.3epss 0.5%
Horilla is a free and open source Human Resource Management System (HRMS). Versions 1.4.0 and above expose unpublished job postings through the /recruitment/recruitment-details// endpoint without authentication. The response includes draft job titles, descriptions and application link allowing unauthenticated users to view unpublished roles and access the application workflow for unpublished jobs. Unauthorized access to unpublished job posts can leak sensitive internal hiring information and cause confusion among candidates. This issue has been fixed in version 1.5.0.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Produtos afetados
horilla-opensource · horilla
CVEs relacionadas — horilla-opensource horilla

No mesmo produto, das mais perigosas para as menos.

CVE-2025-48868HIGHHorilla vulnerable to authenticated RCE via eval() in project_bulk_archiveEPSS 2.5%CVE-2026-24038HIGHHorilla HR has 2FA Bypass through its OTP Handling LogicEPSS 0.5%CVE-2026-24010HIGHHorilla has HTML Injection Issue that, with Phishing, Leads to Account TakeoverEPSS 0.5%CVE-2026-3049MEDIUMhorilla-opensource horilla Query Parameter global_search.py get redirectEPSS 0.4%CVE-2025-48869HIGHHorilla Unauthorized Access to Candidate Resume Files Due to Broken Access ControlEPSS 0.4%CVE-2025-59832CRITICALHorrila Stored XSS Vulnerability via Ticket Comment sectionEPSS 0.4%