A flaw in the Horilla HRMS, identified as a CWE‑284 authentication bypass, exposes draft job titles, descriptions, and application links via the /recruitment/recruitment-details// API endpoint without requiring authentication. This allows any internet user to retrieve sensitive internal hiring data and access the application workflow for unpublished positions, potentially leaking internal hiring strategies and causing confusion among candidates.

Horilla version 1.4.0 and later releases (including 1.4.0) are vulnerable. The affects the Horilla open‑source project; upgrading to version 1.5.0 removes the flaw. No other vendor or product variants are listed.

The CVSS base score of 5.3 indicates a moderate severity, and the EPSS score of less than 1 % suggests low exploitation probability at present. The vulnerability is not in the CISA KEV catalog. Exploitation requires only a simple HTTP GET request to the vulnerable endpoint, which is publicly reachable; therefore the attack vector is likely network-accessible, and no additional authentication or user interaction is needed.