CVE-2026-44341 PUBLISHED

GoJobs: Insecure Direct Object Reference (IDOR) in Job Retrieval Endpoint

Assigner: GitHub_M
Reserved: 05.05.2026 Published: 12.05.2026 Updated: 12.05.2026

GoJobs is a REST API for a Job Board platform. The application exposes a job retrieval endpoint that allows unauthenticated users to access job details by directly manipulating object identifiers. The endpoint lacks proper authentication and authorization checks, resulting in unauthorized access to job data.

Metrics

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
CVSS Score: 5.3

Product Status

Vendor karnop
Product gojobs
Versions
  • Version <= 2cc74a78dcf101c089ea209f2aaefef0674f6b55 is affected

References

Problem Types

  • CWE-284: Improper Access Control CWE
  • CWE-639: Authorization Bypass Through User-Controlled Key CWE