CVE-2026-39348
MediumCVSS 4.3Exploitation Probability (EPSS)
Low risk6th percentile - higher than 6% of all known CVEs
Summary
OrangeHRM Open Source versions 5.0 through 5.8 omit authorization on job specification and vacancy attachment download handlers. Authenticated low-privilege users can read attachments via direct reference to attachment identifiers.
Risk Assessment
Unauthorized access to sensitive attachments, such as CVs or recruitment documents, can compromise candidate and employee privacy.
Recommendation
Update OrangeHRM to version 5.8.1 or later, which includes the fix.
Original NVD description (English source)
OrangeHRM is a comprehensive human resource management (HRM) system. From 5.0 to 5.8, OrangeHRM Open Source omits authorization on job specification and vacancy attachment download handlers, allowing authenticated low-privilege users to read attachments via direct reference to attachment identifiers. This vulnerability is fixed in 5.8.1.