CVE-2026-38566
HighSummary
HireFlow v1.2 does not implement CSRF token validation on any state-changing POST endpoint. All forms are vulnerable to CSRF, allowing an attacker to change the victim's password, delete records, or inject arbitrary data.
Risk Assessment
An attacker can exploit this vulnerability to take control of a user's account, leading to serious data breaches and loss of trust in the system.
Recommendation
It is recommended to implement CSRF token validation on all endpoints and configure the SESSION_COOKIE_SAMESITE attribute to enhance application security.
Other vulnerabilities in HireFlow v1.2
See all- CVE-2026-38568High
HireFlow v1.2 is vulnerable to Incorrect Access Control. The application does not enforce object-level authorization on the /candidate/<id> and /interview/<id> endpoints, allowing access to other users' data.
- CVE-2026-45336Critical
HireFlow versions 1.2 and earlier use a hard-coded Flask secret_key for signing session cookies. Knowing this publicly available value, an unauthenticated attacker can forge cookies with role=admin and arbitrary user_id, bypassing authentication.
- CVE-2026-38567Critical
HireFlow v1.2 is vulnerable to SQL injection in the /login and /search endpoints. User-supplied input is concatenated directly into SQL queries without parameterization.
Original NVD description (English source)
HireFlow v1.2 does not implement CSRF token validation on any state-changing POST endpoint. All forms (password change at /profile, candidate deletion at /candidates/delete/<id>, feedback submission at /feedback/add/<id>, interview scheduling at /interviews/add) are vulnerable to CSRF. An attacker who can trick an authenticated user into visiting a malicious page can silently change the victim's password, delete records, or inject arbitrary data on their behalf. The SESSION_COOKIE_SAMESITE attribute is also not configured, removing the browser-level CSRF defense.