Unauthorized access to resumes stored on LinkedIn

Summary

• Researcher found an IDOR on an endpoint where a recruiter could download resumes without the appropriate access
• This security issue was unintentionally introduced in late-October 2022
• The reporter reached out and provided details to LinkedIn on this security issue in November 2022
• LinkedIn fixed the security issue within 24 hours of being notified
• Our investigation found no evidence of abuse

As LinkedIn is heavily used by recruiters across the globe there are billions of resumes stored in the system.

There are several ways how resumes can be added to LinkedIn:

• Case 1 - when candidate apply to the job post through LinkedIn “Easy Apply” feature and attach resume to the application. In this case access to this resume granted to applicant himself, recruiter who posted specific job on LinkedIn and potentially other recruiters from the company candidate applied to (if the company uses LinkedIn Recruiter product).
• Case 2 - resume can be added to specific LinkedIn profile by recruiter within LinkedIn Recruiter product (tool similar to Applicant Tracking System). In this case access to this resume granted to recruiter who uploaded resume and potentially other recruiters from the same company.

Because of the discovered vulnerability the attacker had a possibility to iterate file IDs and get access to resumes of applicants who either apply to different LinkedIn job posts (case 1) or resumes of professionals which were uploaded to LinkedIn by recruiters (case 2 - without actual candidate application).

LinkedIn security team was very reactive for this report so vulnerability was fixed within very short timeframe.