The GoJobs REST API for the Karnop job board platform contains an access control vulnerability (CWE-284) where the job retrieval endpoint does not enforce authentication or authorization. This allows any unauthenticated user to access job details by directly manipulating object identifiers. The vulnerability affects versions up to the specified commit and has a CVSS 3.1 base score of 5.3 (medium severity), reflecting network attack vector, low complexity, no privileges required, no user interaction, and limited confidentiality impact. No vendor-provided patch or official remediation level is documented, and the product is not a cloud service.

Unauthorized users can retrieve job details without authentication, leading to unauthorized disclosure of potentially sensitive job data. There is no indication of impact on integrity or availability. The vulnerability could expose confidential job information to any network attacker.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the job retrieval endpoint through network controls or implement additional authentication and authorization mechanisms as a temporary mitigation.