CVE-2026-38566: Cross-Site Request Forgery (CSRF)

HireFlow v1.2 does not implement CSRF token validation on any state-changing POST endpoint. All forms password change at /profile, candidate deletion at /candidates/delete/ , feedback submission at /feedback/add/ , interview scheduling at /interviews/add are vulnerable to CSRF. An attacker who ca...