Vulnerability · Published May 12, 2026 · Assigned by GitHub_M

CVE-2026-44341GoJobs: Insecure Direct Object Reference (IDOR) in Job Retrieval Endpoint

Medium 5.3

In plain English

A medium-severity improper access control in gojobs from karnop. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 22% of all known vulnerabilities).

Severity (CVSS 3.1)5.3Medium

Exploit odds (30 days)0.3%top 77.9% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

GoJobs is a REST API for a Job Board platform. The application exposes a job retrieval endpoint that allows unauthenticated users to access job details by directly manipulating object identifiers. The endpoint lacks proper authentication and authorization checks, resulting in unauthorized access to job data.

Affected products (as reported)

Vendor	Product	Versions
karnop	gojobs	<= 2cc74a78dcf101c089ea209f2aaefef0674f6b55

Weakness: CWE-284, CWE-639 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

References

https://github.com/karnop/gojobs/security/advisories/GHSA-x2j8-h9xc-wpgf x_refsource_CONFIRM