{"api_version":"1","generated_at":"2026-05-13T01:06:30+00:00","cve":"CVE-2026-44341","urls":{"html":"https://cve.report/CVE-2026-44341","api":"https://cve.report/api/cve/CVE-2026-44341.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2026-44341","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2026-44341"},"summary":{"title":"GoJobs: Insecure Direct Object Reference (IDOR) in Job Retrieval Endpoint","description":"GoJobs is a REST API for a Job Board platform. The application exposes a job retrieval endpoint that allows unauthenticated users to access job details by directly manipulating object identifiers. The endpoint lacks proper authentication and authorization checks, resulting in unauthorized access to job data.","state":"PUBLISHED","assigner":"GitHub_M","published_at":"2026-05-12 23:16:18","updated_at":"2026-05-12 23:16:18"},"problem_types":["CWE-284","CWE-639","CWE-284 CWE-284: Improper Access Control","CWE-639 CWE-639: Authorization Bypass Through User-Controlled Key"],"metrics":[{"version":"3.1","source":"security-advisories@github.com","type":"Secondary","score":"5.3","severity":"MEDIUM","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","data":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","baseScore":5.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"NONE","availabilityImpact":"NONE"}},{"version":"3.1","source":"CNA","type":"DECLARED","score":"5.3","severity":"MEDIUM","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","data":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":5.3,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","version":"3.1"}}],"references":[{"url":"https://github.com/karnop/gojobs/security/advisories/GHSA-x2j8-h9xc-wpgf","name":"https://github.com/karnop/gojobs/security/advisories/GHSA-x2j8-h9xc-wpgf","refsource":"security-advisories@github.com","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-44341","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-44341","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[{"source":"CNA","vendor":"karnop","product":"gojobs","version":"affected <= 2cc74a78dcf101c089ea209f2aaefef0674f6b55","platforms":[]}],"timeline":[],"solutions":[],"workarounds":[],"exploits":[],"credits":[],"nvd_cpes":[],"vendor_comments":[],"enrichments":{"kev":null,"epss":null,"legacy_qids":[]},"source_records":{"cve_program":{"containers":{"cna":{"affected":[{"product":"gojobs","vendor":"karnop","versions":[{"status":"affected","version":"<= 2cc74a78dcf101c089ea209f2aaefef0674f6b55"}]}],"descriptions":[{"lang":"en","value":"GoJobs is a REST API for a Job Board platform. The application exposes a job retrieval endpoint that allows unauthenticated users to access job details by directly manipulating object identifiers. The endpoint lacks proper authentication and authorization checks, resulting in unauthorized access to job data."}],"metrics":[{"cvssV3_1":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":5.3,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","version":"3.1"}}],"problemTypes":[{"descriptions":[{"cweId":"CWE-284","description":"CWE-284: Improper Access Control","lang":"en","type":"CWE"}]},{"descriptions":[{"cweId":"CWE-639","description":"CWE-639: Authorization Bypass Through User-Controlled Key","lang":"en","type":"CWE"}]}],"providerMetadata":{"dateUpdated":"2026-05-12T22:39:08.112Z","orgId":"a0819718-46f1-4df5-94e2-005712e83aaa","shortName":"GitHub_M"},"references":[{"name":"https://github.com/karnop/gojobs/security/advisories/GHSA-x2j8-h9xc-wpgf","tags":["x_refsource_CONFIRM"],"url":"https://github.com/karnop/gojobs/security/advisories/GHSA-x2j8-h9xc-wpgf"}],"source":{"advisory":"GHSA-x2j8-h9xc-wpgf","discovery":"UNKNOWN"},"title":"GoJobs: Insecure Direct Object Reference (IDOR) in Job Retrieval Endpoint"}},"cveMetadata":{"assignerOrgId":"a0819718-46f1-4df5-94e2-005712e83aaa","assignerShortName":"GitHub_M","cveId":"CVE-2026-44341","datePublished":"2026-05-12T22:39:08.112Z","dateReserved":"2026-05-05T19:52:59.147Z","dateUpdated":"2026-05-12T22:39:08.112Z","state":"PUBLISHED"},"dataType":"CVE_RECORD","dataVersion":"5.2"},"nvd":{"publishedDate":"2026-05-12 23:16:18","lastModifiedDate":"2026-05-12 23:16:18","problem_types":["CWE-284","CWE-639","CWE-284 CWE-284: Improper Access Control","CWE-639 CWE-639: Authorization Bypass Through User-Controlled Key"],"metrics":{"cvssMetricV31":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","baseScore":5.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":3.9,"impactScore":1.4}]},"configurations":[]},"legacy_mitre":{"record":{"CveYear":"2026","CveId":"44341","Ordinal":"1","Title":"GoJobs: Insecure Direct Object Reference (IDOR) in Job Retrieval","CVE":"CVE-2026-44341","Year":"2026"},"notes":[{"CveYear":"2026","CveId":"44341","Ordinal":"1","NoteData":"GoJobs is a REST API for a Job Board platform. The application exposes a job retrieval endpoint that allows unauthenticated users to access job details by directly manipulating object identifiers. The endpoint lacks proper authentication and authorization checks, resulting in unauthorized access to job data.","Type":"Description","Title":"GoJobs: Insecure Direct Object Reference (IDOR) in Job Retrieval"}]}}}