CVE-2026-44341 GoJobs: Insecure Direct Object Reference (IDOR) in Job Retrieval Endpoint
Unauthenticated attackers can access job details by manipulating identifiers due to missing authorization checks in the GoJobs REST API.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-44341?
CVE-2026-44341 is a medium-severity missing authorization vulnerability in karnop gojobs, published on 12 May 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
GoJobs is a REST API for a Job Board platform. The application exposes a job retrieval endpoint that allows unauthenticated users to access job details by directly manipulating object identifiers. The endpoint lacks proper authentication and authorization checks, resulting in unauthorized access to job data.
Which versions are affected by CVE-2026-44341?
How do I fix CVE-2026-44341?
No fix has been published for CVE-2026-44341 yet. Limit exposure of the affected software until one is available.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2026-44341 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-44341 exists.
Sources
Also known as GHSA-x2j8-h9xc-wpgf.