CVE-2026-44341

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-44341", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-05-05T19:52:59.147Z", "datePublished": "2026-05-12T22:39:08.112Z", "dateUpdated": "2026-05-13T14:32:15.465Z"}, "containers": {"cna": {"title": "GoJobs: Insecure Direct Object Reference (IDOR) in Job Retrieval Endpoint", "problemTypes": [{"descriptions": [{"cweId": "CWE-284", "lang": "en", "description": "CWE-284: Improper Access Control", "type": "CWE"}]}, {"descriptions": [{"cweId": "CWE-639", "lang": "en", "description": "CWE-639: Authorization Bypass Through User-Controlled Key", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "version": "3.1"}}], "references": [{"name": "https://github.com/karnop/gojobs/security/advisories/GHSA-x2j8-h9xc-wpgf", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/karnop/gojobs/security/advisories/GHSA-x2j8-h9xc-wpgf"}], "affected": [{"vendor": "karnop", "product": "gojobs", "versions": [{"version": "<= 2cc74a78dcf101c089ea209f2aaefef0674f6b55", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-05-12T22:39:08.112Z"}, "descriptions": [{"lang": "en", "value": "GoJobs is a REST API for a Job Board platform. The application exposes a job retrieval endpoint that allows unauthenticated users to access job details by directly manipulating object identifiers. The endpoint lacks proper authentication and authorization checks, resulting in unauthorized access to job data."}], "source": {"advisory": "GHSA-x2j8-h9xc-wpgf", "discovery": "UNKNOWN"}}, "adp": [{"references": [{"url": "https://github.com/karnop/gojobs/security/advisories/GHSA-x2j8-h9xc-wpgf", "tags": ["exploit"]}], "metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-05-13T14:31:58.461031Z", "id": "CVE-2026-44341", "options": [{"Exploitation": "poc"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-05-13T14:32:15.465Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-44341", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-05-13T14:31:58.461031Z"}}}], "references": [{"url": "https://github.com/karnop/gojobs/security/advisories/GHSA-x2j8-h9xc-wpgf", "tags": ["exploit"]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-05-13T14:32:11.756Z"}}], "cna": {"title": "GoJobs: Insecure Direct Object Reference (IDOR) in Job Retrieval Endpoint", "source": {"advisory": "GHSA-x2j8-h9xc-wpgf", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}}], "affected": [{"vendor": "karnop", "product": "gojobs", "versions": [{"status": "affected", "version": "<= 2cc74a78dcf101c089ea209f2aaefef0674f6b55"}]}], "references": [{"url": "https://github.com/karnop/gojobs/security/advisories/GHSA-x2j8-h9xc-wpgf", "name": "https://github.com/karnop/gojobs/security/advisories/GHSA-x2j8-h9xc-wpgf", "tags": ["x_refsource_CONFIRM"]}], "descriptions": [{"lang": "en", "value": "GoJobs is a REST API for a Job Board platform. The application exposes a job retrieval endpoint that allows unauthenticated users to access job details by directly manipulating object identifiers. The endpoint lacks proper authentication and authorization checks, resulting in unauthorized access to job data."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-284", "description": "CWE-284: Improper Access Control"}]}, {"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-639", "description": "CWE-639: Authorization Bypass Through User-Controlled Key"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-05-12T22:39:08.112Z"}}}, "cveMetadata": {"cveId": "CVE-2026-44341", "state": "PUBLISHED", "dateUpdated": "2026-05-13T14:32:15.465Z", "dateReserved": "2026-05-05T19:52:59.147Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-05-12T22:39:08.112Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "gojobs", "vendor": "karnop", "versions": [{"status": "affected", "version": "<= 2cc74a78dcf101c089ea209f2aaefef0674f6b55"}]}], "source": "security-advisories@github.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "GoJobs is a REST API for a Job Board platform. The application exposes a job retrieval endpoint that allows unauthenticated users to access job details by directly manipulating object identifiers. The endpoint lacks proper authentication and authorization checks, resulting in unauthorized access to job data."}, {"lang": "es", "value": "GoJobs es una API REST para una plataforma de bolsa de trabajo. La aplicaci\u00f3n expone un endpoint de recuperaci\u00f3n de trabajos que permite a usuarios no autenticados acceder a los detalles del empleo manipulando directamente los identificadores de objeto. El endpoint carece de controles adecuados de autenticaci\u00f3n y autorizaci\u00f3n, lo que resulta en acceso no autorizado a los datos del empleo."}], "id": "CVE-2026-44341", "lastModified": "2026-10-26T18:10:00.173", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 1.4, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-44341", "options": [{"exploitation": "poc"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-05-13T14:31:58.461031Z", "version": "2.0.3"}}]}, "published": "2026-05-12T23:16:18.197", "references": [{"source": "security-advisories@github.com", "url": "https://github.com/karnop/gojobs/security/advisories/GHSA-x2j8-h9xc-wpgf"}, {"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "url": "https://github.com/karnop/gojobs/security/advisories/GHSA-x2j8-h9xc-wpgf"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-284"}, {"lang": "en", "value": "CWE-639"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[0,2cc74a78dcf101c089ea209f2aaefef0674f6b55]"}}], "enrichment": {"confidence": 100.0, "confidence_source": "cna", "scores": [{"score": 100.0, "source": "cna"}]}, "original": {"product": "gojobs", "source": "cna", "vendor": "karnop"}, "product": "gojobs", "vendor": "karnop"}], "created": "2026-05-12T23:30:26.592729+00:00", "updated": "2026-05-13T10:35:14.154986+00:00", "vendors": ["karnop", "karnop$PRODUCT$gojobs"]}