PT-2026-30971 · Orangehrm · Orangehrm

Sami Ozcan · Published 2026-04-07 · Updated 2026-04-07 · CVE-2026-39348

Positive Technologies (AI Summary)

CVSS v4.0

5.3

Medium

Base vector

AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions OrangeHRM versions 5.0 through 5.8

Description OrangeHRM Open Source versions 5.0 through 5.8 lack authorization checks on job specification and vacancy attachment download handlers. This allows authenticated, low-privilege users to access attachments directly by referencing attachment identifiers.

Recommendations Update to version 5.8.1 or later.

Fix

Missing Authorization

Weakness Enumeration

CWE-862

Related Identifiers

CVE-2026-39348

Affected Products

Orangehrm

References · 3

• https://github.com/orangehrm/orangehrm/security/advisories/GHSA-mm39-mv56-754r · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-39348 · Security Note
• https://twitter.com/CVEnew/status/2041603160695881876 · Twitter Post