Glassdoor: wasResumeUsed ███ on /api-internal/api.htm endpoint leaking other user's resume usage status

The API endpoint that checks if a resume was used for previous job applications was found to be vulnerable. The endpoint accepted a parameter called "resumeMetadataId" which was not properly validated, allowing an attacker to check the usage status of resumes that did not belong to the user. This...