PT-2026-30971 · Orangehrm · Orangehrm

Sami Ozcan · CVE-2026-39348 · Published 2026-04-07 · Updated 2026-04-07

Positive Technologies (AI Summary)

CVSS v4.0

5.3

Medium

Base vector

AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions OrangeHRM versions 5.0 through 5.8

Description OrangeHRM Open Source versions 5.0 through 5.8 lack authorization checks on job specification and vacancy attachment download handlers. This allows authenticated, low-privilege users to access attachments directly by referencing attachment identifiers.

Recommendations Update to version 5.8.1 or later.

Exploit

Fix

Missing Authorization

Weakness Enumeration

CWE-862

Related Identifiers

CVE-2026-39348

GHSA-MM39-MV56-754R

Affected Products

Orangehrm

References · 5

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/39xxx/CVE-2026-39348.json · Exploit
• https://github.com/orangehrm/orangehrm/security/advisories/GHSA-mm39-mv56-754r · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-39348 · Security Note
• https://osv.dev/vulnerability/CVE-2026-39348 · Vendor Advisory
• https://twitter.com/CVEnew/status/2041603160695881876 · Twitter Post