CVE-2026-24036 — MEDIUM (5.3)

Vulnerability Description

Horilla is a free and open source Human Resource Management System (HRMS). Versions 1.4.0 and above expose unpublished job postings through the /recruitment/recruitment-details// endpoint without authentication. The response includes draft job titles, descriptions and application link allowing unauthenticated users to view unpublished roles and access the application workflow for unpublished jobs. Unauthorized access to unpublished job posts can leak sensitive internal hiring information and cause confusion among candidates. This issue has been fixed in version 1.5.0.

CVSS Score

5.3

MEDIUM

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality

LOW

Integrity

NONE

Availability

NONE

Affected Products

Vendor	Product	Versions
Horilla	Horilla	1.4.0

Related Weaknesses (CWE)

CWE-284

References

https://github.com/horilla-opensource/horilla/commit/9a585a1588431499092a49d7e82Patch
https://github.com/horilla-opensource/horilla/releases/tag/1.5.0Release Notes
https://github.com/horilla-opensource/horilla/security/advisories/GHSA-q4xr-w96pExploitVendor Advisory

FAQ

What is CVE-2026-24036?

CVE-2026-24036 is a vulnerability with a CVSS score of 5.3 (MEDIUM). Horilla is a free and open source Human Resource Management System (HRMS). Versions 1.4.0 and above expose unpublished job postings through the /recruitment/recruitment-details// endpoint without auth...

How severe is CVE-2026-24036?

CVE-2026-24036 has been rated MEDIUM with a CVSS base score of 5.3/10. Review the CVSS metrics above for detailed severity breakdown.

Is there a patch for CVE-2026-24036?

Check the references section above for vendor advisories and patch information. Affected products include: Horilla Horilla.