This vulnerability involves improper access control in the EditEmployeeProfileAPIView function within the accounts/api/views.py file of the django-job-portal project. Specifically, manipulation of the 'role' argument can bypass intended access restrictions. The vulnerability is remotely exploitable and does not require user interaction. The project delivers updates via a rolling release model, and no specific affected or patched versions have been disclosed. The vendor has been notified but has not provided a remediation or official fix at this time. Public exploit code exists, increasing the risk of exploitation.

Successful exploitation could allow an attacker with limited privileges to manipulate the 'role' parameter and gain unauthorized access or modify employee profiles beyond their intended permissions. This could lead to privilege escalation or unauthorized data modification within the Employee Dashboard Endpoint. The vulnerability does not require user interaction and can be triggered remotely, increasing its potential impact. However, the overall severity is rated medium (CVSS 5.3).

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vendor has not responded or issued a fix, users should monitor the project's official channels for updates. Until a fix is available, consider restricting access to the affected API endpoint or implementing additional access control checks at the application or network level to mitigate potential exploitation.