CVE-2026-24036

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-24036", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-01-20T22:30:11.776Z", "datePublished": "2026-01-22T03:21:32.538Z", "dateUpdated": "2026-01-22T12:38:10.451Z"}, "containers": {"cna": {"title": "Horilla Exposes Unpublished Job Disclosures through Unauthenticated API", "problemTypes": [{"descriptions": [{"cweId": "CWE-284", "lang": "en", "description": "CWE-284: Improper Access Control", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "version": "3.1"}}], "references": [{"name": "https://github.com/horilla-opensource/horilla/security/advisories/GHSA-q4xr-w96p-3vg7", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/horilla-opensource/horilla/security/advisories/GHSA-q4xr-w96p-3vg7"}, {"name": "https://github.com/horilla-opensource/horilla/commit/9a585a1588431499092a49d7e82cb77daa4d99ee", "tags": ["x_refsource_MISC"], "url": "https://github.com/horilla-opensource/horilla/commit/9a585a1588431499092a49d7e82cb77daa4d99ee"}, {"name": "https://github.com/horilla-opensource/horilla/releases/tag/1.5.0", "tags": ["x_refsource_MISC"], "url": "https://github.com/horilla-opensource/horilla/releases/tag/1.5.0"}], "affected": [{"vendor": "horilla-opensource", "product": "horilla", "versions": [{"version": ">= 1.4.0, < 1.5.0", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-01-22T03:21:32.538Z"}, "descriptions": [{"lang": "en", "value": "Horilla is a free and open source Human Resource Management System (HRMS). Versions 1.4.0 and above expose unpublished job postings through the /recruitment/recruitment-details// endpoint without authentication. The response includes draft job titles, descriptions and application link allowing unauthenticated users to view unpublished roles and access the application workflow for unpublished jobs. Unauthorized access to unpublished job posts can leak sensitive internal hiring information and cause confusion among candidates. This issue has been fixed in version 1.5.0."}], "source": {"advisory": "GHSA-q4xr-w96p-3vg7", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-01-22T12:37:27.246887Z", "id": "CVE-2026-24036", "options": [{"Exploitation": "poc"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-01-22T12:38:10.451Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-24036", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-01-22T12:37:27.246887Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-01-22T12:38:06.024Z"}}], "cna": {"title": "Horilla Exposes Unpublished Job Disclosures through Unauthenticated API", "source": {"advisory": "GHSA-q4xr-w96p-3vg7", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}}], "affected": [{"vendor": "horilla-opensource", "product": "horilla", "versions": [{"status": "affected", "version": ">= 1.4.0, < 1.5.0"}]}], "references": [{"url": "https://github.com/horilla-opensource/horilla/security/advisories/GHSA-q4xr-w96p-3vg7", "name": "https://github.com/horilla-opensource/horilla/security/advisories/GHSA-q4xr-w96p-3vg7", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/horilla-opensource/horilla/commit/9a585a1588431499092a49d7e82cb77daa4d99ee", "name": "https://github.com/horilla-opensource/horilla/commit/9a585a1588431499092a49d7e82cb77daa4d99ee", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/horilla-opensource/horilla/releases/tag/1.5.0", "name": "https://github.com/horilla-opensource/horilla/releases/tag/1.5.0", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "Horilla is a free and open source Human Resource Management System (HRMS). Versions 1.4.0 and above expose unpublished job postings through the /recruitment/recruitment-details// endpoint without authentication. The response includes draft job titles, descriptions and application link allowing unauthenticated users to view unpublished roles and access the application workflow for unpublished jobs. Unauthorized access to unpublished job posts can leak sensitive internal hiring information and cause confusion among candidates. This issue has been fixed in version 1.5.0."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-284", "description": "CWE-284: Improper Access Control"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-01-22T03:21:32.538Z"}}}, "cveMetadata": {"cveId": "CVE-2026-24036", "state": "PUBLISHED", "dateUpdated": "2026-01-22T12:38:10.451Z", "dateReserved": "2026-01-20T22:30:11.776Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-01-22T03:21:32.538Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "horilla", "vendor": "horilla-opensource", "versions": [{"status": "affected", "version": ">= 1.4.0, < 1.5.0"}]}], "source": "security-advisories@github.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:horilla:horilla:1.4.0:*:*:*:*:*:*:*", "matchCriteriaId": "55143854-C369-4CAA-B671-90EFC9170F64", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Horilla is a free and open source Human Resource Management System (HRMS). Versions 1.4.0 and above expose unpublished job postings through the /recruitment/recruitment-details// endpoint without authentication. The response includes draft job titles, descriptions and application link allowing unauthenticated users to view unpublished roles and access the application workflow for unpublished jobs. Unauthorized access to unpublished job posts can leak sensitive internal hiring information and cause confusion among candidates. This issue has been fixed in version 1.5.0."}, {"lang": "es", "value": "Horilla es un Sistema de Gesti\u00f3n de Recursos Humanos (HRMS) de c\u00f3digo abierto y gratuito. Las versiones 1.4.0 y superiores exponen ofertas de empleo no publicadas a trav\u00e9s del endpoint /recruitment/recruitment-details// sin autenticaci\u00f3n. La respuesta incluye t\u00edtulos de puestos de trabajo en borrador, descripciones y un enlace de solicitud, lo que permite a los usuarios no autenticados ver roles no publicados y acceder al flujo de trabajo de solicitud para trabajos no publicados. El acceso no autorizado a las ofertas de empleo no publicadas puede filtrar informaci\u00f3n interna de contrataci\u00f3n sensible y causar confusi\u00f3n entre los candidatos. Este problema ha sido solucionado en la versi\u00f3n 1.5.0."}], "id": "CVE-2026-24036", "lastModified": "2026-06-17T10:22:29.973", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 1.4, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-24036", "options": [{"exploitation": "poc"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-01-22T12:37:27.246887Z", "version": "2.0.3"}}]}, "published": "2026-01-22T04:15:59.597", "references": [{"source": "security-advisories@github.com", "tags": ["Patch"], "url": "https://github.com/horilla-opensource/horilla/commit/9a585a1588431499092a49d7e82cb77daa4d99ee"}, {"source": "security-advisories@github.com", "tags": ["Release Notes"], "url": "https://github.com/horilla-opensource/horilla/releases/tag/1.5.0"}, {"source": "security-advisories@github.com", "tags": ["Exploit", "Vendor Advisory"], "url": "https://github.com/horilla-opensource/horilla/security/advisories/GHSA-q4xr-w96p-3vg7"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-284"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{"analysis": {"en": {"generated_at": "2026-04-18T15:27:05.903599+00:00", "value": {"mitigation_remediation": ["Apply the Horilla 1.5.0 update, which removes the unauthenticated endpoint.", "If an upgrade cannot be performed immediately, block or restrict access to the /recruitment/recruitment-details// endpoint via firewall or web\u2011application firewall rules.", "Disable or remove any public deployment of the Horilla HRMS installation until the update is applied or the endpoint is secured."], "summary": {"action": "Patch", "impact": "Information disclosure of unpublished job posts"}, "threat_synthesis": {"affected_systems": "Horilla version 1.4.0 and later releases (including 1.4.0) are vulnerable. The affects the Horilla open\u2011source project; upgrading to version 1.5.0 removes the flaw. No other vendor or product variants are listed.", "description_and_impact": "A flaw in the Horilla HRMS, identified as a CWE\u2011284 authentication bypass, exposes draft job titles, descriptions, and application links via the /recruitment/recruitment-details// API endpoint without requiring authentication. This allows any internet user to retrieve sensitive internal hiring data and access the application workflow for unpublished positions, potentially leaking internal hiring strategies and causing confusion among candidates.", "risk_and_exploitability": "The CVSS base score of 5.3 indicates a moderate severity, and the EPSS score of less than 1\u202f% suggests low exploitation probability at present. The vulnerability is not in the CISA KEV catalog. Exploitation requires only a simple HTTP GET request to the vulnerable endpoint, which is publicly reachable; therefore the attack vector is likely network-accessible, and no additional authentication or user interaction is needed."}}}}, "created": "2026-01-22T10:08:08.691348+00:00", "updated": "2026-04-18T15:30:03.965613+00:00", "vendors": ["horilla", "horilla$PRODUCT$horilla"]}