# CVE-2026-38566: StratonWebDesigners HireFlow CSRF in multiple endpoints

Source: https://junglewise.ai/threats/cve-2026-38566-stratonwebdesigners-hireflow-csrf-in-multiple-endpoints  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-05-11. Updated: 2026-05-14  
License: CC BY 4.0 with a link back

CVE-2026-38566 · Severity: high · CVSS 8.1 · Published 2026-05-11

HireFlow, an interview management system used by recruiters to track candidates and schedule interviews, is vulnerable to an attack that can allow unauthorized actions on behalf of logged-in users. By tricking an authenticated administrator or recruiter into visiting a malicious website, an attacker can silently change the victim's password, delete candidate records, or inject false interview feedback. This could lead to a complete takeover of administrative accounts and the loss or corruption of sensitive recruitment data.

Technologies: [StratonWebDesigners HireFlow](https://junglewise.ai/threats/technologies/hireflow). Vendors: [StratonWebDesigners](https://junglewise.ai/threats/vendors/stratonwebdesigners).

## Quick answers

**Is CVE-2026-38566 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-38566 being exploited in the wild.

**How severe is CVE-2026-38566?** High severity, with a CVSS score of 8.1, published 11 May 2026.

**Which products and versions are affected?** StratonWebDesigners HireFlow 1.2.

**Is there a fix for CVE-2026-38566?** A patch was published on 2026-05-11: Fixed in version 1.3 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-38566 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2026-38566?** Check whether you run StratonWebDesigners HireFlow at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

HireFlow v1.2 is vulnerable to Cross-Site Request Forgery (CSRF) because it lacks CSRF token validation on all state-changing POST endpoints, including /profile, /candidates/delete/<id>, /feedback/add/<id>, and /interviews/add. Additionally, the SESSION_COOKIE_SAMESITE attribute is not configured, failing to provide modern browser-level protections. An unauthenticated remote attacker can exploit this by hosting a malicious page with an auto-submitting form; if an authenticated user visits this page, their browser will include session cookies in the cross-origin request. This allows for silent account takeover via password changes or unauthorized modification of the recruitment database. The issue is addressed in version 1.3.

## Affected products

- StratonWebDesigners HireFlow 1.2

## Timeline

- 2026-05-11: disclosed
- 2026-05-11: advisory
- 2026-05-11: patched: Fixed in version 1.3

## References

- [https://github.com/StratonWebDesigners/HireFlow](https://github.com/StratonWebDesigners/HireFlow)
- [https://github.com/hijackedamygdala/CVE-Disclosures/tree/main/HireFlow/CVE-2026-38566](https://github.com/hijackedamygdala/CVE-Disclosures/tree/main/HireFlow/CVE-2026-38566)
- [https://www.sourcecodester.com/python/18688/hireflow-%E2%80%93-complete-interview-management-system.html](https://www.sourcecodester.com/python/18688/hireflow-%E2%80%93-complete-interview-management-system.html)

## Related threats

- [StratonWebDesigners HireFlow authentication bypass via hard-coded secret key](https://junglewise.ai/threats/cve-2026-45336-stratonwebdesigners-hireflow-authentication-bypass-via-hard-coded)
- [StratonWebDesigners HireFlow stored XSS in candidate_detail.html](https://junglewise.ai/threats/cve-2026-38569-stratonwebdesigners-hireflow-stored-xss-in-candidate-detail-html)
- [StratonWebDesigners HireFlow IDOR in candidate and interview endpoints](https://junglewise.ai/threats/cve-2026-38568-stratonwebdesigners-hireflow-idor-in-candidate-and-interview)
- [StratonWebDesigners HireFlow SQL injection in login and search endpoints](https://junglewise.ai/threats/cve-2026-38567-stratonwebdesigners-hireflow-sql-injection-in-login-and-search)