HireFlow v1.2 vulnerabilities
4 known CVE vulnerabilities in HireFlow v1.2, translated and rated.
- CVE-2026-38568High
HireFlow v1.2 is vulnerable to Incorrect Access Control. The application does not enforce object-level authorization on the /candidate/<id> and /interview/<id> endpoints, allowing access to other users' data.
- CVE-2026-38566High
HireFlow v1.2 does not implement CSRF token validation on any state-changing POST endpoint. All forms are vulnerable to CSRF, allowing an attacker to change the victim's password, delete records, or inject arbitrary data.
- CVE-2026-45336Critical
HireFlow versions 1.2 and earlier use a hard-coded Flask secret_key for signing session cookies. Knowing this publicly available value, an unauthenticated attacker can forge cookies with role=admin and arbitrary user_id, bypassing authentication.
- CVE-2026-38567Critical
HireFlow v1.2 is vulnerable to SQL injection in the /login and /search endpoints. User-supplied input is concatenated directly into SQL queries without parameterization.