HireFlow 1.2 suffers from an incorrect access control flaw on the /candidate/ and /interview/ endpoints, allowing any authenticated user to retrieve the data of other users by simply iterating the object IDs supplied in the URL path. This mis‑authorization leads to a horizontal privilege escalation that results in a full data breach of all candidate profiles and interview notes. The weakness corresponds to role‑based privilege escalation (CWE-639).

The vulnerable product is HireFlow, an interview management system available on GitHub and SourceCodester, version 1.2. Any deployment of this version that exposes the described endpoints is affected; no other vendors or versions are listed.

Given that authentication is required but the application fails to verify ownership or role-based permissions, the exploitation is straightforward—an attacker only needs valid credentials and can then enumerate IDs to access any record. The CVSS score of 8.1 further confirms high severity. The lack of EPSS data and KEV status means the exploitation probability is not formally quantified, but the simple attack path and potential for complete data exposure signify a high severity risk.