GoJobs, a REST API for a job board, exposes an endpoint that returns job details without enforcing authentication or proper authorization checks. This flaw, an Insecure Direct Object Reference (IDOR), allows an attacker to modify the job identifier in the request and retrieve information about any job record. The vulnerability results in unauthorized disclosure of job data, compromising confidentiality but not impacting integrity or availability, and is classified under CWE‑284 (Missing Authentication) and CWE‑639 (Privilege Dropping). The CVSS score of 5.3 indicates a medium severity.

The affected system is the GoJobs application maintained by Karnop. No specific version information is provided, implying that all releases lacking mitigation controls may be vulnerable.

The risk level is moderate, as reflected by the CVSS score. EPSS data is not available, and the vulnerability is not listed in CISA KEV, so the likelihood of exploitation is uncertain but cannot be ruled out. Attackers can exploit the flaw by crafting unauthenticated HTTP requests to the job retrieval endpoint, manipulating the job identifier to access any job record. Without proper authentication and authorization, the vulnerability remains exploitable in any environment where the endpoint is exposed. Mitigation is thus essential to prevent potential data leaks.