CVE-2026-39347
LowCVSS 2.7Exploitation Probability (EPSS)
Low risk7th percentile - higher than 7% of all known CVEs
Summary
OrangeHRM is a comprehensive human resource management (HRM) system. From 5.0 to 5.8, OrangeHRM Open Source accepts changes to self-appraisal submissions for administrator users after those submissions have been marked completed, breaking integrity of finalized appraisal records.
Risk Assessment
An administrator can modify completed self-appraisals, potentially leading to falsification of employee appraisal data and compromising the integrity of the evaluation process.
Recommendation
Update OrangeHRM to version 5.8.1 or later.
Original NVD description (English source)
OrangeHRM is a comprehensive human resource management (HRM) system. From 5.0 to 5.8, OrangeHRM Open Source accepts changes to self-appraisal submissions for administrator users after those submissions have been marked completed, breaking integrity of finalized appraisal records. This vulnerability is fixed in 5.8.1.