VulnerabilityAnalyzed

CVE-2026-24036

Versions 1.4.0 and above expose unpublished job postings through the /recruitment/recruitment-details// endpoint without authentication.

MEDIUM 5.3EPSS 0.48%

Does this matter?

Lower severity and a low EPSS score (0.48%). Track it; it rarely justifies an emergency change on its own.

Description

Horilla is a free and open source Human Resource Management System (HRMS). Versions 1.4.0 and above expose unpublished job postings through the /recruitment/recruitment-details// endpoint without authentication. The response includes draft job titles, descriptions and application link allowing unauthenticated users to view unpublished roles and access the application workflow for unpublished jobs. Unauthorized access to unpublished job posts can leak sensitive internal hiring information and cause confusion among candidates. This issue has been fixed in version 1.5.0.

CVSS 3.1: 5.3 MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
EPSS: 0.48% probability · 40th percentile
CISA KEV: Not listed
Weakness: CWE-284
Affected: horilla/horilla
Source: security-advisories@github.com

References

https://github.com/horilla-opensource/horilla/commit/9a585a1588431499092a49d7e82cb77daa4d99eePatch
https://github.com/horilla-opensource/horilla/releases/tag/1.5.0Release Notes
https://github.com/horilla-opensource/horilla/security/advisories/GHSA-q4xr-w96p-3vg7Exploit, Vendor Advisory

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.