Johnson & Johnson Campus Recruiting web application contains a flaw that permits users to view personal data supplied by prospective recruits and internal notes created by interviewers. The vulnerability results in unauthorized disclosure of sensitive information that could be used for identity fraud, targeted phishing, or other privacy violations. It reflects a lack of proper access-602.

The affected system is the Johnson & Johnson Campus Recruiting web application, with all releases prior to 2025‑10‑31 vulnerable. No specific sub‑versions are listed, so any deployment of the legacy system before the cutoff date is at risk.

The CVSS score of 7.5 indicates a high severity, but the exploit is likely to be straightforward once an authenticated session is established, due to the absence of role checks on sensitive endpoints. The EPSS score is not available listed in the CISA KEV catalog, suggesting it may not yet be widely exploited. Attackers would simply need legitimate access to the system to retrieve data, making prevalence high for internal actors.