The vulnerability exists because HireFlow version 1.2 omits CSRF token validation on all state‑changing POST endpoints. The affected endpoints include password change, candidate deletion, feedback submission, and interview scheduling. Without a CSRF token and without the SESSION_COOKIE_SAMESITE attribute, a malicious page can trigger these actions silently when an authenticated user visits it, allowing the attacker to change the victim’s password, delete records, or submit arbitrary data. The weakness leads to loss of confidentiality, integrity, and availability of user data.

HireFlow v1.2, an interview management system built in Python, is the only affected product. All users logged into this version are vulnerable to the described attacks.

The EPSS score is < 1%, indicating a low likelihood of exploitation, and it is not listed in CISA’s KEV catalog, indicating it is not currently known to be actively exploited. However, the attack surface is high because it requires only that an authenticated user visit a malicious webpage, which can be achieved through phishing or compromised content. The CVSS score is 8.1, indicating a high severity.