CVE-2026-24036: Horilla Exposes Unpublished Job Disclosures through Unauthenticated API
Horilla is a free and open source Human Resource Management System (HRMS). Versions 1.4.0 and above expose unpublished job postings through the /recruitment/recruitment-details// endpoint without authentication. The response includes draft job titles, descriptions and application link allowing unauthenticated users to view unpublished roles and access the application workflow for unpublished jobs. Unauthorized access to unpublished job posts can leak sensitive internal hiring information and cause confusion among candidates. This issue has been fixed in version 1.5.0.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2026-24036?
CVE-2026-24036 is categorized as a medium-severity vulnerability due to the exposure of unpublished job postings through an unauthenticated API.
How do I fix CVE-2026-24036?
To fix CVE-2026-24036, update to Horilla version 1.5.0 or later, which addresses the vulnerability by implementing required authentication for the affected API endpoint.
What versions of Horilla are affected by CVE-2026-24036?
CVE-2026-24036 affects all Horilla versions from 1.4.0 up to but not including 1.5.0.
What kind of data is exposed by CVE-2026-24036?
CVE-2026-24036 exposes unpublished job postings, which may contain confidential job-related information.
Is authentication required to access the vulnerable endpoint in CVE-2026-24036?
No, authentication is not required to access the /recruitment/recruitment-details/ endpoint, making it susceptible to unauthorized access.