Executive brief
GoJobs is a REST API used for managing job board platforms. A security flaw allows anyone on the internet to view job details without logging in by simply changing the ID number in the web address. This could lead to the bulk theft of job listing data and the exposure of internal business information.
Technical details
An Insecure Direct Object Reference (IDOR) vulnerability exists in the GET /jobs/{id} endpoint of the GoJobs REST API. The application fails to perform authentication or authorization checks when retrieving job records, relying solely on the user-provided ID parameter. Because these identifiers are predictable (sequential integers), a remote, unauthenticated attacker can enumerate and scrape the entire database of job listings. At the time of the advisory, no patched version has been released; mitigations include implementing authentication, role-based access control, and using UUIDs instead of sequential IDs.
Affected products
- karnop GoJobs All versions (current main branch)
Timeline
- 2026-04-29: advisory: GitHub Security Advisory published by the maintainer
- 2026-05-12: disclosed: CVE published to the National Vulnerability Database (NVD)