CVE-2026-39346
MediumCVSS 5.4Exploitation Probability (EPSS)
Low risk5th percentile - higher than 5% of all known CVEs
Summary
OrangeHRM Open Source from 5.0 to 5.8 allowed authenticated users to bypass disabled-module access controls via URL-encoded request paths and access functionality of modules disabled by an administrator. Fixed in 5.8.1.
Risk Assessment
Authenticated users can access functions that should be unavailable to them, potentially leading to unauthorized actions or data leakage.
Recommendation
Update OrangeHRM to version 5.8.1 or later.
Original NVD description (English source)
OrangeHRM is a comprehensive human resource management (HRM) system. From 5.0 to 5.8, OrangeHRM Open Source allowed authenticated users to bypass disabled-module access controls via URL-encoded request paths and access functionality of modules disabled by an administrator. This vulnerability is fixed in 5.8.1.