Improper Access Control in django-job-portal Employee Dashboard

Executive Summary

CVE-2026-15188 is a privilege escalation vulnerability in the django-job-portal application. An authenticated user with a low-privilege employee role can escalate their privileges to the employer role by sending a request to the profile-update endpoint with the role field set to "employer".

The vulnerability exists because the serializer used by the endpoint allows the role field to be modified, even though it governs access control in the application. The authorization classes check the user's role to determine access, but the role field is not protected from modification.

This allows an attacker to change their role to "employer" and gain access to employer-only capabilities, such as viewing and altering applicant data, creating jobs, and accessing the employer dashboard.

The attack requires only a valid JWT token and does not need a CSRF token.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability allows a low-privilege employee user to escalate their privileges to an employer role, which can lead to unauthorized access to sensitive employer-only functions.

• Viewing and altering applicant data without authorization.
• Creating job postings that should be restricted to employers.
• Accessing the employer dashboard and other restricted endpoints.

Such unauthorized access can lead to data breaches, manipulation of job postings, and compromise of the integrity of the job portal system.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability can be detected by attempting to exploit the privilege escalation flaw in the django-job-portal application. Specifically, an authenticated user with a low-privilege employee role can send a PUT request to the profile-update endpoint with the role field set to "employer" to check if the role change is accepted and persists.

A sample command to test this would be using curl with a valid JWT token to send the PUT request:

• curl -X PUT https://<target-domain>/accounts/api/profile/ -H "Authorization: Bearer <valid_jwt_token>" -H "Content-Type: application/json" -d '{"role": "employer"}'

If the response indicates success and the user's role changes to employer, the vulnerability is present.

Useful 0 Not Useful 0

Mitigation Strategies

Immediate mitigation steps include restricting modification of the role field in the profile update endpoint to prevent unauthorized role changes.

Specifically, the application should ensure that the serializer used in the EditEmployeeProfileAPIView does not allow the role field to be updated by users, or that proper authorization checks are enforced before accepting changes to the role.

Additionally, monitoring and logging attempts to modify the role field can help detect exploitation attempts.

Since the project uses a rolling release model and has not yet responded to the issue, applying custom patches or temporarily disabling the profile update functionality for role changes may be necessary until an official fix is released.

Useful 0 Not Useful 0

Compliance Impact

The vulnerability allows an authenticated low-privilege employee to escalate their privileges to an employer role, granting unauthorized access to employer-only capabilities such as viewing and altering applicant data, creating jobs, and accessing the employer dashboard.

This improper access control and privilege escalation could lead to unauthorized access and potential misuse of personal and sensitive data, which may impact compliance with data protection regulations like GDPR and HIPAA that require strict access controls and protection of personal information.

However, the provided information does not explicitly discuss the direct impact on compliance with these standards.

Useful 0 Not Useful 0