Executive brief
A security vulnerability exists in the Django Job Portal application, a platform used for managing job listings and applications. An authenticated user registered as a job seeker (employee) can exploit this flaw to elevate their account privileges to that of an employer. This allows unauthorized users to create job postings, view sensitive applicant data, and modify hiring statuses, potentially compromising the privacy of other users and the integrity of the recruitment process.
Technical details
A privilege escalation vulnerability exists in the `EditEmployeeProfileAPIView` within `accounts/api/views.py`. The root cause is an over-permissive `UserSerializer` that fails to mark the `role` field as read-only or exclude it from request-writable fields. An authenticated attacker with 'employee' permissions can send a PUT request to the `/api/employee/profile/` endpoint containing a modified `role` parameter set to 'employer'. Because the application's authorization logic (e.g., `IsEmployer` permission class) relies solely on this `role` string in the user model, the attacker successfully gains access to employer-only functionality, including job creation and applicant management. Public exploits have been disclosed, and the project uses a rolling release model with no official patch confirmed at the time of reporting.
Affected products
- manjurulhoque django-job-portal up to dfa352f305bba44445ac5dc12e9b2a98c9dcd71f
Timeline
- 2026-06-08: disclosed: Issue reported on GitHub by AliceS614
- 2026-07-09: advisory: CVE published by VulDB/NVD