CVE-2026-38566 Details
Description
HireFlow v1.2 does not implement CSRF token validation on any state-changing POST endpoint. All forms (password change at /profile, candidate deletion at /candidates/delete/<id>, feedback submission at /feedback/add/<id>, interview scheduling at /interviews/add) are vulnerable to CSRF. An attacker who can trick an authenticated user into visiting a malicious page can silently change the victim's password, delete records, or inject arbitrary data on their behalf. The SESSION_COOKIE_SAMESITE attribute is also not configured, removing the browser-level CSRF defense.
A Cross-Site Request Forgery (CSRF) vulnerability exists in HireFlow version 1.2, as the application fails to validate CSRF tokens on any state-changing POST endpoint. This issue affects all forms, including password changes, candidate deletions, feedback submissions, and interview scheduling. An attacker who can deceive an authenticated user into visiting a malicious page could silently alter the user's password, remove records, or submit data on their behalf. Additionally, the absence of the SESSION_COOKIE_SAMESITE attribute eliminates a crucial browser-level defense against CSRF attacks.
Users are advised to update to HireFlow version 1.3, where this vulnerability has been patched. For those using an earlier version, implementing CSRF tokens on all state-changing POST forms and setting the SESSION_COOKIE_SAMESITE attribute in the Flask configuration are recommended.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed May 11, 2026CISA-ADP
Assessed May 12, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/hijackedamygdala/CVE-Disclosures/tree/main/HireFlow/CVE-2026-38566 | CISA-ADP | ExploitRemedyTechnical Description |
| https://github.com/hijackedamygdala/CVE-Disclosures/tree/main/HireFlow/CVE-2026-38566 | [email protected] | ExploitRemedyTechnical Description |
| https://github.com/StratonWebDesigners/HireFlow | [email protected] | ProductSource CodeVendor |
| https://www.sourcecodester.com/python/18688/hireflow-%E2%80%93-complete-interview-management-system.html | [email protected] | ProductVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-352 | Cross-Site Request Forgery (CSRF) | CISA-ADP |
Affected Products
| Product | Versions |
|---|---|
| StratonWebDesigners HireFlow | All versions |
CPE
Remediation
| |
Change History
4 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| May 12, 2026 | CVE Modified | CISA-ADP |
| May 11, 2026 | New CVE Received | [email protected] |