Use of GET request method with sensitive query strings vulnerability in Bilin Software and Informatics Consultancy Inc. (CVE-2026-14838)
A vulnerability in Bilin Software and Informatics Consultancy Inc.'s HUMANIST Digital Human Resources product allows sensitive information to be exposed via the use of the GET request method with sensitive query strings, potentially enabling session hijacking. This affects versions from 26.0 up to but not including 26.1.
AI Analysis
Technical Summary
The vulnerability (CVE-2026-14838) in HUMANIST Digital Human Resources involves the use of the GET HTTP request method to transmit sensitive query strings, which can lead to session hijacking. This occurs because sensitive session information is exposed in URLs, which may be logged or intercepted. The affected versions are from 26.0 before 26.1. The CVSS vector indicates network attack vector, high attack complexity, no privileges required, no user interaction, unchanged scope, and high confidentiality and integrity impact with no availability impact.
Potential Impact
Successful exploitation can lead to session hijacking, allowing an attacker to gain unauthorized access to user sessions, compromising confidentiality and integrity of user data. There is no impact on availability. The vulnerability is rated high severity with a CVSS score of 7.4.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, avoid exposing sensitive information in GET request query strings and consider using POST requests or other secure methods to transmit sensitive data.
Use of GET request method with sensitive query strings vulnerability in Bilin Software and Informatics Consultancy Inc. (CVE-2026-14838)
Description
A vulnerability in Bilin Software and Informatics Consultancy Inc.'s HUMANIST Digital Human Resources product allows sensitive information to be exposed via the use of the GET request method with sensitive query strings, potentially enabling session hijacking. This affects versions from 26.0 up to but not including 26.1.
CVSS v3.1
Score 7.4high
Affected software
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The vulnerability (CVE-2026-14838) in HUMANIST Digital Human Resources involves the use of the GET HTTP request method to transmit sensitive query strings, which can lead to session hijacking. This occurs because sensitive session information is exposed in URLs, which may be logged or intercepted. The affected versions are from 26.0 before 26.1. The CVSS vector indicates network attack vector, high attack complexity, no privileges required, no user interaction, unchanged scope, and high confidentiality and integrity impact with no availability impact.
Potential Impact
Successful exploitation can lead to session hijacking, allowing an attacker to gain unauthorized access to user sessions, compromising confidentiality and integrity of user data. There is no impact on availability. The vulnerability is rated high severity with a CVSS score of 7.4.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, avoid exposing sensitive information in GET request query strings and consider using POST requests or other secure methods to transmit sensitive data.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- GHSA-chm9-7crh-67fc
- Osv Schema Version
- 1.4.0
- Aliases
- ["CVE-2026-14838"]
- Ecosystems
- []
- Database Specific Severity
- HIGH
- Cvss Version
- 3.1
Threat ID: 6a71feebbf8831d539ff11b5
Added to database: 08/04/2026, 15:02:03 UTC
Last enriched: 08/04/2026, 15:14:28 UTC
Last updated: 08/04/2026, 15:41:01 UTC
Views: 2
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.