PT-2025-48369 · Orangehrm · Orangehrm
Published
2025-11-29
·
Updated
2025-11-29
·
CVE-2025-66291
CVSS v4.0
5.3
Medium
| Vector | AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N |
Name of the Vulnerable Software and Affected Versions
OrangeHRM versions 5.0 through 5.7
Description
OrangeHRM, a human resource management system, has an issue in the Recruitment module where interview attachments can be accessed without proper authorization. The issue affects versions 5.0 through 5.7. The interview attachment retrieval endpoint does not verify if the user requesting the file has permission to access the associated interview record. An ESS-level user, lacking access to recruitment workflows, can request interview attachment URLs and retrieve confidential documents such as candidate CVs and evaluations. This is due to the system relying on predictable object identifiers and session presence instead of validating the user’s association with the recruitment process. The issue is addressed in version 5.8. The API endpoint involved is the interview attachment retrieval endpoint within the Recruitment module. The vulnerability stems from a lack of authorization checks before serving files based on user-supplied identifiers, specifically the attachment ID (
attachment id).Recommendations
Versions 5.0 through 5.7 should be updated to version 5.8 or later to resolve this issue.
Exploit
Fix
Improper Authorization
Information Disclosure
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Orangehrm