CVE-2026-39349
LowCVSS 2.7Exploitation Probability (EPSS)
Low risk2th percentile - higher than 2% of all known CVEs
Summary
OrangeHRM Open Source from version 5.0 to 5.8 encrypts sensitive fields with AES in ECB mode, preserving plaintext patterns in ciphertext and enabling pattern disclosure against stored data. Fixed in version 5.8.1.
Risk Assessment
The organization is at risk of pattern disclosure of sensitive data stored in the HRM system, potentially leading to information leakage.
Recommendation
Upgrade OrangeHRM Open Source to version 5.8.1 or later.
Other vulnerabilities in OrangeHRM
See all- CVE-2026-39348Medium
OrangeHRM Open Source versions 5.0 through 5.8 omit authorization on job specification and vacancy attachment download handlers. Authenticated low-privilege users can read attachments via direct reference to attachment identifiers.
- CVE-2026-39347Low
OrangeHRM is a comprehensive human resource management (HRM) system. From 5.0 to 5.8, OrangeHRM Open Source accepts changes to self-appraisal submissions for administrator users after those submissions have been marked completed, breaking integrity of finalized appraisal records.
- CVE-2026-39346Medium
OrangeHRM Open Source from 5.0 to 5.8 allowed authenticated users to bypass disabled-module access controls via URL-encoded request paths and access functionality of modules disabled by an administrator. Fixed in 5.8.1.
- CVE-2026-39345Medium
OrangeHRM Open Source versions 5.0 to 5.8 fail to restrict email template file resolution to the intended plugins directory, allowing an authenticated attacker who can influence the template path to read arbitrary local files. This is fixed in version 5.8.1.
Original NVD description (English source)
OrangeHRM is a comprehensive human resource management (HRM) system. From 5.0 to 5.8, OrangeHRM Open Source encrypts certain sensitive fields with AES in ECB mode, which preserves block-aligned plaintext patterns in ciphertext and enables pattern disclosure against stored data. This vulnerability is fixed in 5.8.1.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS