VYPR
← All advisories
Medium severity5.4NVD Advisory· Published Apr 7, 2026· Updated Apr 9, 2026

CVE-2026-39346

CVE-2026-39346

Description

OrangeHRM is a comprehensive human resource management (HRM) system. From 5.0 to 5.8, OrangeHRM Open Source allowed authenticated users to bypass disabled-module access controls via URL-encoded request paths and access functionality of modules disabled by an administrator. This vulnerability is fixed in 5.8.1.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

2
  • Orangehrm/Orangehrm2 versions
    cpe:2.3:a:orangehrm:orangehrm:*:*:*:*:*:*:*:*+ 1 more
    • cpe:2.3:a:orangehrm:orangehrm:*:*:*:*:*:*:*:*range: >=5.0,<5.8.1
    • (no CPE)range: >=5.0, <=5.8

Patches

Vulnerability mechanics

References

1

News mentions

0

No linked articles in our index yet.