This vulnerability (CWE-598) arises from the use of the HTTP GET method to transmit sensitive query strings in HUMANIST Digital Human Resources software. Because GET requests append data to the URL, sensitive session information may be exposed, increasing the risk of session hijacking attacks. The affected versions are 26.0 up to but not including 26.1. The CVSS 3.1 score is 7.4, indicating high severity with network attack vector, high complexity, no privileges required, no user interaction, and high impact on confidentiality and integrity but no impact on availability. There is no vendor advisory or patch available at this time.

An attacker could exploit this vulnerability to hijack user sessions by capturing sensitive information transmitted via GET request query strings. This compromises confidentiality and integrity of user sessions, potentially allowing unauthorized access to user accounts or sensitive data. Availability is not impacted.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, avoid transmitting sensitive information via GET request query strings and consider using POST requests or other secure methods to handle sensitive data. Implement additional session security controls such as secure cookies and HTTPS to reduce risk.