The vulnerability resides in the EditEmployeeProfileAPIView of the django‑job‑portal application and represents a combination of privilege management errors (CWE‑266) and improper access control (CWE‑284). By manipulating the role parameter in this endpoint, an attacker can bypass employee profiles beyond their authorized level, potentially granting elevated privileges or access to confidential employee data.

The flaw affects the django‑job‑portal project hosted by manjurulhoque. No specific version numbers are available because the project uses a rolling release model. Users running any snapshot of the code up to the commit dfa352f305bba44445ac5dc12e9b2a98c9dcd71f are at risk.

With a CVSS score of 5.3, the vulnerability is considered moderate. The EPSS score is < 1%, and the issue is not listed in the CISA KEV catalog. Exploitation can be performed remotely by sending a crafted request to the affected API endpoint; the attack vector is inferred to be remote due to the nature of the web API.