PT-2026-30970 · Orangehrm · Orangehrm

Sagar-Devaraja · Published 2026-04-07 · Updated 2026-04-07 · CVE-2026-39347

Positive Technologies (AI Summary)

CVSS v4.0

5.1

Medium

Base vector

AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions OrangeHRM versions 5.0 through 5.8

Description OrangeHRM Open Source allows changes to self-appraisal submissions for administrator users after those submissions have been marked completed, compromising the integrity of finalized appraisal records.

Recommendations Update to version 5.8.1 or later.

Fix

Improper Authorization

Weakness Enumeration

CWE-285

Related Identifiers

CVE-2026-39347

Affected Products

Orangehrm

References · 3

• https://github.com/orangehrm/orangehrm/security/advisories/GHSA-7j84-w7h5-24pc · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-39347 · Security Note
• https://twitter.com/CVEnew/status/2041603162054783101 · Twitter Post