VYPR
← All advisories
Medium severity4.3NVD Advisory· Published Apr 7, 2026· Updated Apr 10, 2026

CVE-2026-39348

CVE-2026-39348

Description

OrangeHRM is a comprehensive human resource management (HRM) system. From 5.0 to 5.8, OrangeHRM Open Source omits authorization on job specification and vacancy attachment download handlers, allowing authenticated low-privilege users to read attachments via direct reference to attachment identifiers. This vulnerability is fixed in 5.8.1.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

2
  • Orangehrm/Orangehrm2 versions
    cpe:2.3:a:orangehrm:orangehrm:*:*:*:*:*:*:*:*+ 1 more
    • cpe:2.3:a:orangehrm:orangehrm:*:*:*:*:*:*:*:*range: >=5.0,<5.8.1
    • (no CPE)range: >=5.0, <=5.8

Patches

Vulnerability mechanics

References

1

News mentions

0

No linked articles in our index yet.