CVE-2026-57912 Overview
CVE-2026-57912 affects the Johnson & Johnson Campus Recruiting web application in versions before 2025-10-31. The vulnerability permits unauthorized viewing of data submitted by recruited students and internal notes written about students by interviewers. The flaw is categorized under [CWE-602] Client-Side Enforcement of Server-Side Security, indicating that access restrictions were enforced on the client rather than validated on the server. An unauthenticated remote attacker can access sensitive candidate information over the network without user interaction. According to the disclosure by Eaton Works, the exposure includes personally identifiable information (PII) and confidential interviewer notes tied to individual candidates.
Critical Impact
Unauthenticated network attackers can retrieve student PII and confidential interviewer notes from the Johnson & Johnson Campus Recruiting platform.
Affected Products
- Johnson & Johnson Campus Recruiting web application (all builds before 2025-10-31)
Discovery Timeline
- 2026-06-26 - CVE-2026-57912 published to NVD
- 2026-06-26 - Last updated in NVD database
Technical Details for CVE-2026-57912
Vulnerability Analysis
The Johnson & Johnson Campus Recruiting application enforces access restrictions in client-side code rather than on the server. This design pattern maps to [CWE-602] Client-Side Enforcement of Server-Side Security. An attacker who bypasses or modifies the client interface can request server endpoints directly and receive candidate data intended only for authenticated recruiters and interviewers.
The exposed data set includes information voluntarily supplied by student applicants and evaluative notes recorded by interviewing staff. Both categories carry confidentiality expectations under employment privacy standards. The scope is limited to information disclosure; integrity and availability of the application are not affected according to the published CVSS vector.
The vulnerability is reachable over the network, requires no privileges, and needs no user interaction. This combination makes automated enumeration of candidate records straightforward for an attacker who identifies the affected endpoints.
Root Cause
The root cause is trust placed in the client to enforce authorization. Server-side handlers return sensitive candidate records without independently validating the requesting session's role or ownership of the requested resource. Removing or modifying client-side checks — or issuing requests outside the browser entirely — grants the same responses that authorized recruiters would receive.
Attack Vector
The attack vector is remote and unauthenticated. An attacker sends crafted HTTP requests to the recruiting application's backend endpoints and receives candidate records in the response. Enumeration of numeric or predictable identifiers can expand access from a single candidate profile to the full applicant population. Refer to the Eaton Works disclosure for the specific request paths and observed behavior.
Detection Methods for CVE-2026-57912
Indicators of Compromise
- Unusual volumes of authenticated or anonymous requests to candidate record endpoints from a single source IP or client fingerprint
- Sequential or scripted access patterns iterating over candidate identifiers
- Requests to backend APIs originating from non-browser user agents or missing expected session cookies
Detection Strategies
- Review web server and application logs for direct API access that bypasses the normal recruiter UI navigation flow
- Correlate authentication events with data-access events to identify record retrieval without a preceding valid recruiter login
- Alert on responses returning candidate PII to sessions that never completed multi-factor or SSO authentication
Monitoring Recommendations
- Ingest application, WAF, and CDN logs into a centralized analytics platform for cross-source correlation
- Baseline normal recruiter query rates and alert on statistical deviations indicating scraping
- Monitor egress data volumes from the recruiting application for spikes consistent with bulk record extraction
How to Mitigate CVE-2026-57912
Immediate Actions Required
- Confirm the Campus Recruiting application build date is 2025-10-31 or later; upgrade any earlier instances
- Rotate API keys and session secrets associated with the recruiting platform
- Notify affected students and interviewers if log review indicates unauthorized access to their records
Patch Information
Johnson & Johnson addressed the issue in the Campus Recruiting release dated 2025-10-31. All builds released before this date are affected. No CPE identifiers or downloadable patch artifacts are published in NVD; remediation is delivered through the hosted application. Consult the Eaton Works Blog Post for background on the disclosed behavior.
Workarounds
- Restrict access to the recruiting portal to corporate network ranges or VPN sources while confirming the fixed build is deployed
- Enforce server-side authorization checks on every candidate data endpoint, independent of client-supplied role indicators
- Add rate limiting and anomaly detection at the WAF layer to slow enumeration attempts against candidate identifiers
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
